CVE-2026-76032

Name of the Vulnerable Software and Affected Versions Pydio Cells versions 5.0.0 through 5.0.2

Description An authorization bypass exists in the REST handler for the endpoint "GET /a/share/link/{Uuid}" within the idm/share/rest/handler.go file. The handler processes the Uuid variable from the path and calls the LinkById() function without performing an authorization check. This differs from the "GET /a/share/cell/{Uuid}" handler, which requires MatchPolicies with ResourcePolicyAction READ to prevent unauthorized disclosure. Because the GetLinkWorkspace function leads to GetOrCreateWorkspace, which executes SearchWorkspace without a ResourcePolicyQuery, the workspace service fails to apply policy filters. Since the workspace UUID is exposed as START REPOSITORY on unauthenticated public share pages, any authenticated user with a standard role can provide the UUID to retrieve sensitive information, including the link hash, URL, owner identifier, hidden share user login, permission set, download limits, target users, expiry date, and password requirements.

Recommendations Update Pydio Cells to a version later than 5.0.2. As a temporary mitigation, restrict access to the "GET /a/share/link/{Uuid}" endpoint.