Suse CVE-2026-30943

The CVSS score of 4.1 with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N reflects a network-accessible vulnerability with low attack complexity but high privilege requirement, affecting system integrity across security boundaries. The vulnerability requires an authenticated user (PR:H), which significantly raises the operational bar compared to unauthenticated attacks. However, the real-world risk is elevated by several factors: the attack is completely automated with no user interaction required, the permission combination needed (PERM_REPLACE and PERM_LIST) is common in collaborative file systems, and the technical impact—unauthorized file deletion—causes irreversible data loss. The fact that this exploits a logical flaw in authorization logic rather than a cryptographic or protocol weakness means exploitation is straightforward once the API behavior is understood. Without KEV or EPSS data explicitly provided, the moderate CVSS score combined with the straightforward exploitation path and cross-boundary integrity impact suggests this merits prompt patching, particularly in multi-tenant or shared resource environments where such permission separation is critical.

An authenticated user with PERM_REPLACE (permission to replace their own files) and PERM_LIST (permission to view other users' files) logs into the system, identifies a file belonging to another user through the list API, and crafts a replace request targeting that file with deleteNewFile set to true. Because the API endpoint fails to check whether the user possesses PERM_DELETE_OTHER_UPLOADS, the authorization check passes, and the target file is deleted. The attacker leaves no evidence of traditional deletion, as the file removal was processed through a replace operation. Multiple files can be deleted rapidly in sequence by automating requests against known file identifiers.