How to use this reference
Editorial lesson: permission changes must constrain previously issued capabilities, not only new capability creation. The merged remediation checks the owner's current sharing and download permissions during public access. Its pull-request description records separate regression cases for revoking either permission. Model issuance and later use as distinct authorization decisions.
Before reading
- Basic server-side authorization concepts
Context and limits
- Requires an existing share and access to its link, followed by revocation of the owner's relevant permissions. This is a source-reported demonstration, not independently reproduced here; no production exposure is established.
- CVE-2026-35604. The advisory lists versions through 2.62.2 as affected and 2.63.1 as patched; it does not resolve the intervening-version gap. Pull request 5888 was merged April 4, 2026; that merge date is not a verified package-release date.
- Published by hacdias; Koda Reef (kodareef5) is credited as reporter and authored the remediation pull request. Resource edition is unspecified. The repository displayed an August 31, 2026 archive notice at review.
Sources and provenance
- Share links remain accessible after Share/Download permissions are revoked File Browser · reviewed 2026-10-03
- Pull request 5888: share-owner permission revalidation File Browser · reviewed 2026-10-03
Record reviewed 2026-10-03. Snapshot 53796974ace8. Open the complete JSON contract.