CVE-2026-126936

MediumCVSS 5.9/10Last modified Nov 13, 2026

Description

Zipline before 4.7.0 contains a race condition vulnerability that allows users to bypass invitation usage limits, upload storage quotas, and shortened-URL quotas through concurrent requests. Attackers can send overlapping registration, upload, or URL creation requests that pass checks against stale state, creating extra accounts and exceeding administrator-configured resource quotas.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-367

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
diced	zipline	< 4.7.0

References

Timeline

Published: Nov 13, 2026
Last modified: Nov 13, 2026
NVD status: Received

Related CVEs from 2026

CVE-2026-1269378.1Zipline before 4.6.5 contains a TOCTOU race condition in the POST /api/setup endpoint that allows unauthenticated attackers to create multip CVE-2026-1269387.1Zipline before 4.6.4 contains a resource allocation vulnerability that allows authenticated users to bypass chunked-upload size and quota ch CVE-2026-1269395.3Zipline before 4.6.4 contains an information disclosure vulnerability in GET /api/server/folder/:id that allows unauthenticated attackers to CVE-2026-126949.1Missing Authorization vulnerability in Vimesoft Inc. Enterprise Video Platform allows Accessing Functionality Not Properly Constrained by AC CVE-2026-1269406.5Zipline before 4.6.4 contains a rate limit bypass vulnerability that allows remote attackers to evade request limits by varying query string CVE-2026-1269416.8Zipline through 4.6.2 contains an authorization bypass vulnerability that allows authenticated administrators to read superadmin secrets bec CVE-2026-1269425.4Zipline before 4.6.2 contains a missing authorization vulnerability in POST /api/user/folders that allows authenticated users to reparent ot CVE-2026-1269434.9Zipline from 4.2.0 before 4.6.2 contains an information disclosure vulnerability that logs sensitive environment variable values, such as OA CVE-2026-1269445.7Zipline before 4.6.1 contains a path traversal vulnerability in LocalDatasource that allows SUPERADMIN users to read or delete files outside CVE-2026-1269458.7Zipline before 4.5.1 contains a stored cross-site scripting vulnerability in the HighlightCode component that renders unescaped file content CVE-2026-1269465.4Zipline from 4.3.0 before 4.5.0 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject CVE-2026-1269475.4Zipline before 4.5.0 contains a stored open redirect vulnerability that allows authenticated users to set arbitrary short URL destinations b