CVE-2026-126948

EUVD-2026-125117
Zipline before 4.5.0 contains an insecure direct object reference vulnerability caused by missing ownership verification in the PATCH and DELETE handlers for /api/user/folders/:id. Authenticated attackers can supply another user's folder ID to rename it, make it public, enable uploads, or delete it.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 38.96%
Common Weakness Enumeration
References
https://github.com/diced/zipline/security/advisories/GHSA-fgwh-2pc5-wr73
https://www.vulncheck.com/advisories/zipline-before-4.5.0-idor-via-folder-patch-and-delete-endpoints
https://github.com/diced/zipline/security/advisories/GHSA-fgwh-2pc5-wr73