CVE-2026-82582
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized attacker to retrieve files from the groupware's shared file feature.
Risk Assessment
An unauthorized attacker may gain access to files shared within the groupware, potentially leading to leakage of confidential information.
Recommendation
Update SHIRASAGI to a version containing the fix and verify access controls for shared files.
Other vulnerabilities in SHIRASAGI
See all- CVE-2026-118869High
An OS command injection vulnerability exists in SHIRASAGI. An authenticated attacker may execute arbitrary OS commands on the system running the product.
- CVE-2026-117679Medium
A cross-site scripting vulnerability exists in SHIRASAGI. An authenticated attacker may execute arbitrary script in a user's web browser when the user accesses a website using the affected product.
- CVE-2026-81635Medium
A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of a user who accesses a website using the affected product.
Original NVD description (English source)
An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized attacker to retrieve files from the groupware's shared file feature.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS