CVE-2026-40189: goshs has a file-based ACL authorization bypass in goshs state-changing routes

Vulnerability summary

CVE-2026-40189 is a critical (CVSS 9.8) Missing Authorization vulnerability in goshs. EPSS estimates a 0.66% chance of exploitation in the next 30 days, higher than 50.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 10-04-2026
   PublishedVulnerability first disclosed.
2. 13-04-2026
   Last modifiedVulnerability information updated.

Description

goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.4, goshs enforces the documented per-folder .goshs ACL/basic-auth mechanism for directory listings and file reads, but it does not enforce the same authorization checks for state-changing routes. An unauthenticated attacker can upload files with PUT, upload files with multipart POST /upload, create directories with ?mkdir, and delete files with ?delete inside a .goshs-protected directory. By deleting the .goshs file itself, the attacker can remove the folder's auth policy and then access previously protected content without credentials. This results in a critical authorization bypass affecting confidentiality, integrity, and availability. This vulnerability is fixed in 2.0.0-beta.4.

• CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.