CVE-2026-126948

CVSS 8.8 (high) · published 2026-11-13

Zipline before 4.5.0 contains an insecure direct object reference vulnerability caused by missing ownership verification in the PATCH and DELETE handlers for /api/user/folders/:id. Authenticated attackers can supply another user's folder ID to rename it, make it public, enable uploads, or delete it.

Weakness: CWE-639

Source: NVD CVE-2026-126948

References

• https://github.com/diced/zipline/security/advisories/GHSA-fgwh-2pc5-wr73
• https://www.vulncheck.com/advisories/zipline-before-4.5.0-idor-via-folder-patch-and-delete-endpoints
• https://github.com/diced/zipline/security/advisories/GHSA-fgwh-2pc5-wr73

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.