HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-56768 — Seahub before 13.0.23 does not enforce SHARE_LINK_LOGIN_REQUIRED on GET /api/v2....

·Source: NIST NVD

Updated:

Executive Summary

Seahub before 13.0.23 does not enforce SHARE_LINK_LOGIN_REQUIRED on GET /api/v2.1/share-link-zip-task/, allowing unauthenticated users to bypass authentication. Attackers with a folder share-link token can call the GET endpoint to obtain a fileserver zip token and download entire shared directory trees.

Analysis

Seahub before 13.0.23 does not enforce SHARE_LINK_LOGIN_REQUIRED on GET /api/v2.1/share-link-zip-task/, allowing unauthenticated users to bypass authentication. Attackers with a folder share-link token can call the GET endpoint to obtain a fileserver zip token and download entire shared directory trees. CVSS Score: 8.8. Published: 2026-06-25T19:16:43.840.

Indicators of Compromise (1)

CVE (1)
CVE-2026-56768
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jun 25, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

Loanch expands into Southeast Asia

Loanch, a Croatia-based marketplace for alternative lending-based investments, announces the addition of AhaPay to its marketplace. Loanch clients can access investment opportunities, expanding their exposure to the growing fintech sector in Southeast Asia.

Finextra
MEDIUMVulnerabilityNEW

Google leads $30m round for space fintech Nebex

Google Ventures has led a $30 million seed round for Nebex, a market infrastructure platform for the "global space economy".

Finextra
MEDIUMVulnerability

FlexTrade integrates with EDX Markets for institutional-grade crypto trading

FlexTrade Systems, a global leader in multi-asset execution and order management systems, and EDX Markets (EDX), a leading digital asset technology firm that combines an institutional-only trading venue with a central clearinghouse, today announced the integration of EDX into FlexTrade’s crypto and digital assets trading solution, FlexDigitalAssets.

Finextra