| id: GO-2026-5881 | |
| modules: | |
| - module: goshs.de/goshs | |
| vulnerable_at: 1.1.4 | |
| - module: goshs.de/goshs/v2 | |
| versions: | |
| - fixed: 2.1.0 | |
| vulnerable_at: 2.0.9 | |
| summary: 'goshs: Share-link ?token=… redemption races past download limit in goshs.de/goshs' | |
| cves: | |
| - CVE-2026-50139 | |
| ghsas: | |
| - GHSA-j48m-h7xq-2xpj | |
| references: | |
| - advisory: https://github.com/patrickhener/goshs/security/advisories/GHSA-j48m-h7xq-2xpj | |
| source: | |
| id: GHSA-j48m-h7xq-2xpj | |
| created: 2026-07-06T17:42:10.640280046-04:00 | |
| review_status: UNREVIEWED |