CVE-2026-40189 is a critical authorization bypass vulnerability in the goshs SimpleHTTPServer written in Go. Versions prior to 2.0.0-beta.4 enforce ACL/basic-auth only on directory listings and file reads but do not enforce authorization on state-changing HTTP routes such as PUT, multipart POST /upload, ?mkdir, and ?delete. This allows unauthenticated attackers to upload files, create directories, delete files, and remove the .goshs file that contains the folder's auth policy, effectively disabling authentication and exposing protected content. The vulnerability impacts confidentiality, integrity, and availability. The issue is resolved in goshs version 2.0.0-beta.4.

An unauthenticated attacker can bypass authorization controls to perform unauthorized file uploads, directory creation, and file deletions within protected directories. By deleting the .goshs authorization file, the attacker can disable folder-level authentication, gaining access to previously protected content without credentials. This leads to a critical compromise of confidentiality, integrity, and availability of the affected server.

Upgrade goshs to version 2.0.0-beta.4 or later, where this authorization bypass vulnerability is fixed. Since no official patch link or advisory is provided, verify the upgrade from the official project source. Until upgraded, restrict access to goshs servers to trusted networks to reduce exposure.