CVE-2026-56768 describes a missing authorization enforcement in haiwen's Seahub product prior to version 13.0.23. Specifically, the vulnerability exists because the SHARE_LINK_LOGIN_REQUIRED setting is not enforced on the GET /api/v2.1/share-link-zip-task/ API endpoint. Attackers with a valid folder share-link token can exploit this flaw to call the endpoint without authentication, retrieve a fileserver zip token, and download entire shared directory trees. This represents an authorization bypass vulnerability allowing unauthorized data access.

The vulnerability allows unauthenticated attackers who have a folder share-link token to bypass authentication controls and download entire shared directory trees. This could lead to unauthorized disclosure of sensitive files shared via Seahub. The CVSS 4.0 score of 8.7 (high severity) reflects the network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict distribution of folder share-link tokens and monitor access to shared links. Avoid exposing share-link tokens publicly. Implement additional access controls or network restrictions to limit exploitation risk.