What is CVE-2026-110230?

CVE-2026-110230 is a medium-severity vulnerability in Sergix44 Xbackbone, classified under Missing Authorization. CVSS score: 5.4/10. Published 2026-10-13.

How severe is CVE-2026-110230?

Medium severity. CVSS v3 base score is 5.4 out of 10.

Auth bypass in Sergix44 Xbackbone

CVE-2026-110230

XBackBone through 3.8.2 contains a missing authorization vulnerability that allows authenticated users to change other users' upload share codes via the POST /upload/{id}/vanity route. Attackers can supply sequential upload ids to MediaController::createVanity() to break existing share links and hijack the freed codes with their own uploads.

Vulnerability class: Broken Access Control

Published 2026-10-13 · last modified 2026-10-13.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Sergix44 Xbackbone

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

github.com/sergix44/xbackbone/pull/671 (issue-tracking, patch)
github.com/sergix44/xbackbone/commit/5e91a2a9859d20e41ee2e2403cfbe673804f6221 (patch)
hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/ByAj-Xoifl (third-party-advisory)
github.com/sergix44/xbackbone/blob/226af4f0cec218f563da6d53ececfa4708e6f3e7/app… (technical-description)
github.com/sergix44/xbackbone (product)
www.vulncheck.com/advisories/xbackbone-through-3.8.2-missing-authorization-via-… (third-party-advisory)

Frequently asked questions

What is CVE-2026-110230?: CVE-2026-110230 is a medium-severity vulnerability in Sergix44 Xbackbone, classified under Missing Authorization. CVSS score: 5.4/10. Published 2026-10-13.
How severe is CVE-2026-110230?: Medium severity. CVSS v3 base score is 5.4 out of 10.