OxiCloud CVE-2026-111332

The attacker must already hold a valid oxi_shares share-ring cookie that was granted while the targeted share was still public (before the owner enabled password protection), and that cookie must remain valid. Exploitation is then performed by replaying that cookie against GET /api/files/{id}. Limiting factors: the attacker must have had prior anonymous access to the specific share before it was password-protected (reflected as AT:P in the CVSS 4.0 vector), so users who never accessed a share before its password was set cannot leverage this; impact is confined to reading shared file content and folder listings (no write/modify or availability impact). Affected versions are OxiCloud 0.9.1 through 0.9.3.

The input CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L) yields 6.3 (Medium), and the signals are internally consistent: network-reachable (AV:N) and unauthenticated (PR:N), but gated by an attack requirement (AT:P) and limited to low confidentiality impact (VC:L) with no integrity or availability effect. The AT:P flag is the decisive signal - exploitation is not opportunistic because the attacker must already possess a valid oxi_shares share-ring cookie issued before the owner enabled password protection, which inherently narrows the population to parties who previously accessed the share. There is no CISA KEV listing, so this is NOT confirmed actively exploited. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified or compared here. No SSVC decision data was provided. A detailed third-party technical writeup (hackmd) and vulnerable source-code line references exist, but no weaponized/working exploit code is flagged in the input. Net assessment: a real but modest-priority confidentiality bug - meaningful for anyone relying on OxiCloud password protection to retroactively revoke prior anonymous access, but not a broad unauthenticated-RCE-class emergency. Prioritize patching for exposed instances; do not treat as a drop-everything issue absent KEV/EPSS escalation.

An anonymous visitor accesses a public OxiCloud share and is issued an oxi_shares share-ring cookie. The share owner later adds password protection expecting to revoke public access, but the visitor - still holding the old cookie - continues to issue GET /api/files/{id} requests and reads the supposedly protected files and folder listings. A detailed technical writeup documenting the flaw is publicly available, though no packaged exploit tool is indicated in the input.