CVE-2026-103028: CWE-863: Incorrect Authorization in drakkan sftpgo

SFTPGo, an open source file transfer solution, contains an incorrect authorization vulnerability (CWE-863) in versions from 2.5.0 up to but not including 2.7.6. The flaw allows an authenticated user with copy permission to circumvent file-pattern filters that are intended to restrict access to certain source files. Because these filters are only evaluated on the destination path, users can copy files denied by denied_patterns or outside allowed_patterns to allowed destination names and thereby read their contents. Recursive directory copies can reproduce restricted files under allowed paths, bypassing hide policies that normally prevent file visibility in directory listings. Other security controls such as home-directory boundaries and administrative authorization remain effective. The vulnerability has a CVSS 3.1 base score of 4.3 (medium severity) and was published on 2026-10-13. The issue is resolved in SFTPGo version 2.7.6.

An authenticated user with copy permission can read files that should be restricted by file-pattern filters, potentially exposing sensitive data. The vulnerability allows bypassing of denied_patterns and allowed_patterns restrictions on source files during copy operations. However, other security mechanisms such as home-directory boundaries, virtual-folder layouts, per-directory permissions, and administrative authorization are not bypassed. The impact is limited to unauthorized reading of files that are otherwise hidden or denied by pattern filters.

Upgrade SFTPGo to version 2.7.6 or later, where this authorization issue is fixed. No other mitigation is required as the vulnerability is resolved in the official fix.