CVE-2026-76032 is a missing authorization vulnerability in Pydio Cells 5.0.0 through 5.0.2. The REST endpoint GET /a/share/link/{Uuid} returns share-link details to any authenticated user without performing authorization checks. The handler reads the workspace UUID from the path and calls LinkById, but does not verify if the requesting user has permission to access the share link. The workspace UUID is publicly exposed in unauthenticated share pages, allowing any authenticated user with a standard role to retrieve sensitive share-link metadata. Other related handlers enforce resource policy checks and return not-found errors to avoid disclosing existence, but this handler does not. The vulnerability allows unauthorized disclosure of share-link metadata, although direct access to the shared node is still restricted.

An authenticated user with a standard role can retrieve sensitive metadata about share links they are not authorized to access. This includes the share link hash and URL, the owner's user identifier, hidden share user login, permission sets, download limits and counts, target users, expiry times, and whether a password is required. While direct access to the shared content is still denied, this information disclosure could aid attackers in further reconnaissance or targeted attacks against shared resources.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user roles to limit exposure and monitor access to share-link endpoints. Avoid sharing workspace UUIDs publicly if possible. Follow vendor guidance once an official fix or update is released for Pydio Cells versions 5.0.0 through 5.0.2.