CVE-2026-11345mediumCWE-287

CVE-2026-11345: medium-severity vulnerability in linqi

Improper Authentication Bypass in linqi CDN File Access

Published

Follow this CVE+ Monitor linqi

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.9epss 0.4%
An Improper Authentication vulnerability in the /api/Cdn/GetFile endpoint of linqi allows unauthenticated, remote attackers to bypass file access controls. The ValidateAnonFileAccess function incorrectly grants access if an 'AnonFile' query parameter containing exactly 256 characters is provided. While this flaw allows bypassing the intended authorization check, the actual security impact is negligible; the exposed resources are strictly limited to minified JavaScript and CSS files that contain no sensitive data and are already publicly accessible via a standard CDN.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
linqi GmbH · linqi
Related CVEs — linqi

In the same product, most dangerous first.

CVE-2026-11346MEDIUMServer-Side Request Forgery (SSRF) allowing Internal Network Probing in linqiEPSS 0.2%CVE-2026-11369HIGHIDOR in Comment API Allows Cross-Process Comment Read and WriteEPSS 0.2%CVE-2026-11347HIGHHardcoded Cryptographic Keys and Weak IV Generation in linqiEPSS 0.1%