XBackBone EUVD-2026-99014

Requires a valid authenticated account on the target XBackBone instance (PR:L); the attacker needs no admin rights and no user interaction. Exploitation uses the POST /upload/{id}/vanity route (MediaController::createVanity) with attacker-chosen numeric upload ids that belong to other users, which succeeds because the pre-fix query looked up uploads by id alone without verifying ownership. Limiting factors: the attacker must be able to obtain an account (exposure depends on whether self-registration is enabled versus invite/admin-only), upload ids are sequential and therefore easily guessable, and impact is confined to integrity/availability of share links (no data disclosure). Affects XBackBone versions 0 through 3.8.2.

This is a genuine but modest-severity issue, and the available signals are consistent rather than conflicting. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L) correctly characterizes it as a network-reachable, low-complexity flaw requiring low privileges (an authenticated account) with no user interaction, and only partial integrity/availability impact and no confidentiality impact - matching the description of a missing authorization (CWE-862) defect that lets one authenticated user rewrite another user's share codes. CISA's SSVC framework aligns with a low-priority rating: Exploitation=none (no observed exploitation), Automatable=no, and Technical Impact=partial. No EPSS score was provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no confirmed public exploit, so this is not an urgent patch-now item. Net assessment: a legitimate vulnerability worth remediating, but a medium-CVSS, low-real-risk issue - it does not grant code execution or data disclosure, requires a valid account on the instance, and only enables sabotage/hijacking of share links. The vulncheck advisory and vendor commit confirm the flaw is real.

An authenticated low-privilege user on a shared XBackBone instance iterates through sequential numeric upload IDs and sends POST /upload/{id}/vanity requests to reassign the vanity share code of uploads they do not own. This breaks the victim's existing share links and lets the attacker re-register the freed codes to point at their own content. No public exploit is confirmed, but the attack is trivial given the AV:N/AC:L/PR:L/UI:N vector.