PT-2026-146780

CVE-2026-126936

Published

2026-11-13

Updated

2026-11-13

Description by

CVSS 4.0

6.0

Medium

MetricsAV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Zipline versions prior to 4.7.0

Description A race condition exists that allows users to bypass invitation usage limits, upload storage quotas, and shortened-URL quotas. By sending concurrent and overlapping requests for registration, uploading, or URL creation, attackers can bypass checks performed against stale state. This enables the creation of extra accounts and the exceeding of resource quotas configured by administrators.

Recommendations Update Zipline to version 4.7.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Tonghuaroot

Vendors

Affected products

Weakness enumeration

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

Related identifiers