CVE-2026-11345mediumCWE-287

CVE-2026-11345: falha de média gravidade em linqi

Improper Authentication Bypass in linqi CDN File Access

Publicada em

Seguir esta CVE+ Monitorar linqi

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.9epss 0.4%
An Improper Authentication vulnerability in the /api/Cdn/GetFile endpoint of linqi allows unauthenticated, remote attackers to bypass file access controls. The ValidateAnonFileAccess function incorrectly grants access if an 'AnonFile' query parameter containing exactly 256 characters is provided. While this flaw allows bypassing the intended authorization check, the actual security impact is negligible; the exposed resources are strictly limited to minified JavaScript and CSS files that contain no sensitive data and are already publicly accessible via a standard CDN.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
linqi GmbH · linqi
CVEs relacionadas — linqi

No mesmo produto, das mais perigosas para as menos.

CVE-2026-11346MEDIUMServer-Side Request Forgery (SSRF) allowing Internal Network Probing in linqiEPSS 0.2%CVE-2026-11369HIGHIDOR in Comment API Allows Cross-Process Comment Read and WriteEPSS 0.2%CVE-2026-11347HIGHHardcoded Cryptographic Keys and Weak IV Generation in linqiEPSS 0.1%