CVE-2026-29061: Gokapi Privilege Escalation via Incomplete API-Key Permission Revocation
Summary
CVE-2026-29061: Gokapi has privilege escalation via incomplete API-key permission revocation on user rank demotion. Affects github.com/forceu/gokapi versions < 2.2.3. Fixed in 2.2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gokapi is an open-source API management tool designed for managing file requests and application logs. It allows users to interact with various endpoints for uploading files and monitoring system status. However, it has a critical vulnerability related to user rank demotion that can lead to privilege escalation, allowing demoted users to retain access to sensitive functionalities.
Vulnerability Detail
The vulnerability arises from the user rank demotion logic in Gokapi, where a demoted user retains their existing API keys with elevated permissions (ApiPermManageFileRequests and ApiPermManageLogs). This oversight allows users who have been demoted from Admin rank to continue accessing upload-request management and log viewing endpoints, potentially leading to unauthorized actions such as creating, listing, and deleting upload requests, as well as reading application logs and system status.
How To Fix
Latest published version: v1.9.6 as of 23 Oct 2026
go get github.com/forceu/gokapi@v1.9.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.2.3
This is the first release that contains the fix.
go get github.com/forceu/gokapi@v2.2.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, manually revoke API keys for any user who has been demoted from Admin rank to prevent unauthorized access. This can be done by accessing the API key management section and removing the keys associated with the demoted user.
Conclusion
The privilege escalation vulnerability in Gokapi due to incomplete API-key permission revocation poses a significant risk to application security. It is crucial for users to update to the patched version 2.2.3 to mitigate this risk and ensure proper access control.
See every vulnerability recorded for github.com/forceu/gokapi →
FAQ
The vulnerability allows demoted users to retain elevated API permissions, leading to potential unauthorized access.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities.
Impacts include unauthorized management of upload requests and access to sensitive application logs, which could compromise system integrity.
Yes, the vulnerability is patched in version 2.2.3 of Gokapi. It is recommended to update to this version.
The CVSS score of this vulnerability is 5.4, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/forceu/gokapi.
