CVE-2026-82582 is an authorization bypass vulnerability in SHIRASAGI where an attacker can use a user-controlled key to bypass access controls and retrieve files from the shared file feature of the groupware. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). The CVSS v3.0 base score is 4.3 (medium severity) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and limited confidentiality impact. There is no information about affected versions or available patches.

An unauthorized attacker with low privileges can bypass authorization controls to access files shared within the SHIRASAGI groupware. The impact is limited to confidentiality as the attacker can retrieve files they should not have access to. There is no reported impact on integrity or availability. No known exploits are currently active in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the shared file feature to trusted users only and monitor for unusual access patterns related to file retrieval. Avoid exposing the service to untrusted networks if possible.