CVE-2026-111332: Incorrect Authorization in AtalayaLabs OxiCloud

CVE-2026-111332 describes an incorrect authorization vulnerability in AtalayaLabs OxiCloud versions 0.9.1 through 0.9.3. The flaw allows anonymous visitors who possess a valid oxi_shares share-ring cookie to bypass newly added password protections and access shared files or folder contents through the API endpoint GET /api/files/{id}. This vulnerability arises because the system does not properly invalidate or re-check authorization tokens after password protection is applied to shared content.

An attacker with an existing share-ring cookie can continue to access shared files or folders without authentication, bypassing password protection controls. This could lead to unauthorized disclosure of sensitive shared data. The CVSS 4.0 base score is 6.3 (medium severity), indicating a moderate risk due to network attack vector, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider invalidating existing share-ring cookies or disabling sharing features that rely on this mechanism. Monitor vendor communications for official patches or updates addressing this authorization flaw.