CVE-2026-128970 Missing membership acceptance check permits group share-right deletion by invitees in Psono Server

Psono Server Community Edition versions 1.12.6 through 7.5.0 and Psono Server Enterprise Edition before 7.5.1 do not require accepted group membership when authorizing deletion of group share-rights. The DELETE /share/right/ endpoint checks for a membership matching the target group, the...

CVE-2026-128970

Psono Server Community Edition (versions 1.12.6 through 7.5.0) and Enterprise Edition (before 7.5.1) are vulnerable to an authorization bypass in the DELETE /share/right/ endpoint. The system fails to verify if a group membership has been accepted (accepted=True) before authorizing the deletion o...