Which versions of Seahub are affected by EUVD-2026-39520?

Seafile's Seahub web interface contains an authorization bypass in share-link functionality that allows attackers with valid tokens to download entire shared directory trees without proper…. A patch is available.

How to fix or mitigate EUVD-2026-39520?

Within 24 hours: Inventory all Seahub deployments and identify instances running versions before 13.0.23; prioritize internet-facing or sensitive-data instances. Within 7 days: Upgrade all affected Seahub instances to version 13.0.23 or later after staging validation. Within 30 days: Audit historical share-link access logs for unauthorized downloads; review share-link policies and user permissions; complete remediation documentation.

Seahub EUVD-2026-39520

Q: What is the CVSS score of EUVD-2026-39520?

EUVD-2026-39520 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-56768 HIGH

Missing Authorization (CWE-862)

2026-06-25 VulnCheck

GHSA-w52g-25r7-3c46

Authentication Bypass Seahub

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable, low-complexity bypass needing only a share-link token (PR:L, no UI); impact is mass disclosure of shared files so C:H, with no evidenced integrity or availability impact (I:N/A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 25, 2026 - 18:52 vuln.today

Analysis Generated

Jun 25, 2026 - 18:52 vuln.today

DescriptionCVE.org

Seahub before 13.0.23 does not enforce SHARE_LINK_LOGIN_REQUIRED on GET /api/v2.1/share-link-zip-task/, allowing unauthenticated users to bypass authentication. Attackers with a folder share-link token can call the GET endpoint to obtain a fileserver zip token and download entire shared directory trees.

AnalysisAI

Authorization bypass in Seahub (the Seafile web frontend) before 13.0.23 lets a holder of a folder share-link token call GET /api/v2.1/share-link-zip-task/ without honoring the SHARE_LINK_LOGIN_REQUIRED policy, obtaining a fileserver zip token to download entire shared directory trees. Classified as CWE-862 (Missing Authorization) and reported by VulnCheck with a vendor patch available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. EPSS data was not provided in the input.

Technical ContextAI

Seahub is the Django/Python web application that fronts the Seafile self-hosted file sync-and-share platform, exposing REST APIs under /api/v2.1/. The affected endpoint, ShareLinkZipTaskView, is implemented in seahub/api2/endpoints/share_link_zip_task.py and issues a fileserver zip token used to bulk-download a shared folder as a ZIP archive. The root cause (CWE-862, Missing Authorization) is that the GET handler did not evaluate the SHARE_LINK_LOGIN_REQUIRED configuration flag before serving the token, so the login-required gate that administrators rely on to force authentication for share links was simply never checked on this code path. The vendor fix (commits b609949c and 162cddae) adds an explicit guard returning HTTP 403 when SHARE_LINK_LOGIN_REQUIRED is set and request.user.is_authenticated is false. CPE cpe:2.3:a:haiwen:seahub identifies the Haiwen Seahub product as affected.

RemediationAI

Upgrade Seahub to the fixed release: Vendor-released patch: 13.0.23, which adds the SHARE_LINK_LOGIN_REQUIRED enforcement to the GET handler (see fix commits https://github.com/haiwen/seahub/commit/b609949cf64ed6a15708d0fb5ea9c179962e23cc and https://github.com/haiwen/seahub/commit/162cddae0831188d02bb8d451dc2193e197dcc57, and the VulnCheck advisory https://www.vulncheck.com/advisories/seahub-authentication-bypass-in-sharelinkziptaskview-get-method). If you cannot patch immediately, treat existing folder share-link tokens as potentially abusable and revoke or rotate sensitive share links, and where feasible block or restrict access to the /api/v2.1/share-link-zip-task/ endpoint at a reverse proxy (note this disables legitimate bulk-ZIP download of shared folders). Because the bypass specifically defeats SHARE_LINK_LOGIN_REQUIRED, also consider password-protecting individual share links and setting expirations to limit exposure, accepting that this adds friction for legitimate recipients.