Oxicloud
Monthly
OxiCloud 0.9.1 through 0.9.3 fails to revoke previously issued anonymous share grants when a share owner turns on password protection, so anyone still holding an oxi_shares share-ring cookie can continue reading shared files and folder listings through GET /api/files/{id} (CVSS 6.3, Medium; CWE-863). Exploitation is unauthenticated (PR:N) but gated by an attack requirement (AT:P): the attacker must have already accessed that specific share while it was public and must still possess the resulting cookie, and the resulting impact is limited to disclosure of shared content with no integrity or availability effect. No public exploit identified at time of analysis.
OxiCloud 0.9.1 through 0.9.3 fails to revoke previously issued anonymous share grants when a share owner turns on password protection, so anyone still holding an oxi_shares share-ring cookie can continue reading shared files and folder listings through GET /api/files/{id} (CVSS 6.3, Medium; CWE-863). Exploitation is unauthenticated (PR:N) but gated by an attack requirement (AT:P): the attacker must have already accessed that specific share while it was public and must still possess the resulting cookie, and the resulting impact is limited to disclosure of shared content with no integrity or availability effect. No public exploit identified at time of analysis.