CVE-2026-126942

Versions of Zipline before 4.6.2 are vulnerable to a missing authorization vulnerability in the POST /api/user/folders endpoint. This flaw allows authenticated users to reparent files belonging to other users by providing specific file IDs. An attacker can harvest these IDs from public folders to...