XBackBone through version 3.8.2 suffers from a missing authorization flaw that permits any authenticated user to modify another user’s upload share codes via the POST /upload/{id}/vanity route. By supplying sequential upload identifiers to MediaController::createVanity(), an attacker can break existing share links and hijack the freed codes with their own uploads. This allows unauthorized access to content that was shared by other users and can lead to data leakage or disruption of expected sharing behavior.

The vulnerability affects the XBackBone platform released by sergix44. All releases up to and including version 3.8.2 are impacted; later versions contain a fix. The specific affected endpoint is /upload/{id}/vanity, which handles vanity URL creation for user uploads.

The CVSS score of 5.3 indicates a moderate risk. EPSS information is not available, so the probability of exploitation cannot be quantified from the data. The flaw does not allow remote code execution, and an attacker needs to be already authenticated to use the endpoint, reducing the likelihood of widespread exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting no public exploits are known at this time. Overall, while the impact is limited to unauthorized manipulation of share codes, the attack vector requires prior authentication, making the risk moderate but still actionable.