CVE-2026-110230

XBackBone through 3.8.2 contains a missing authorization vulnerability that allows authenticated users to change other users' upload share codes via the POST /upload/id/vanity route. Attackers can supply sequential upload ids to MediaController::createVanity to break existing share links and hija...

EUVD-2026-99014

XBackBone through 3.8.2 contains a missing authorization vulnerability that allows authenticated users to change other users' upload share codes via the POST /upload/id/vanity route. Attackers can supply sequential upload ids to MediaController::createVanity to break existing share links and hija...

CVE-2026-110230 XBackBone through 3.8.2 Missing Authorization via Upload Vanity Endpoint

XBackBone through 3.8.2 contains a missing authorization vulnerability that allows authenticated users to change other users' upload share codes via the POST /upload/id/vanity route. Attackers can supply sequential upload ids to MediaController::createVanity to break existing share links and hija...

CVE-2026-110230

The software XBackBone versions through 3.8.2 is vulnerable to a missing authorization flaw in the POST /upload/{id}/vanity route. This vulnerability allows authenticated users to modify the upload share codes of other users by providing sequential upload IDs to the MediaController::createVanity(...

CVE-2026-110230 XBackBone through 3.8.2 Missing Authorization via Upload Vanity Endpoint

XBackBone through 3.8.2 contains a missing authorization vulnerability that allows authenticated users to change other users' upload share codes via the POST /upload/id/vanity route. Attackers can supply sequential upload ids to MediaController::createVanity to break existing share links and hija...

CVE-2026-110230

XBackBone through 3.8.2 contains a missing authorization vulnerability that allows authenticated users to change other users' upload share codes via the POST /upload/id/vanity route. Attackers can supply sequential upload ids to MediaController::createVanity to break existing share links and hija...

PT-2026-111853

XBackBone through 3.8.2 contains a missing authorization vulnerability that allows authenticated users to change other users' upload share codes via the POST /upload/id/vanity route. Attackers can supply sequential upload ids to MediaController::createVanity to break existing share links and hija...

CVE-2026-110230: Missing Authorization

XBackBone through 3.8.2 contains a missing authorization vulnerability that allows authenticated users to change other users' upload share codes via the POST /upload/id/vanity route. Attackers can supply sequential upload ids to MediaController::createVanity to break existing share links and hija...

Sergio Brighenti XBackBone authorization issue vulnerability

Sergio Brighenti’s XBackBone 3.8.2 and earlier versions have an authorization issue. This vulnerability stems from a lack of authorization verification. Certified users can use the POST /upload/id/vanity route to change other users’ upload sharing codes. An attacker could provide consecutive uplo...