OxiCloud versions 0.9.1 through 0.9.3 contain an incorrect authorization flaw that allows an anonymous visitor to retain access to shared content after password protection is imposed. The vulnerability is rooted in an improper handling of share‑ring authentication tokens (CWE-863), which results in attacker‑controlled cookies continuing to grant access to protected files via the API.

The affected product is AtalayaLabs OxiCloud. All releases from version 0.9.1 up to and including 0.9.3 are vulnerable. No information about later versions or patches is provided in the current data.

The flaw scores a moderate CVSS score of 6.3, indicating a noticeable impact if exploited. The EPSS score is below 1%, showing a low but non‑zero probability of exploitation in the wild, and the vulnerability is not listed in CISA KEV. Exploitation requires the attacker to possess a valid oxi_shares cookie, and the attacker then performs a GET request to /api/files/{id} to read files or folder contents that are meant to be protected by a new password. When the attacker has the cookie, the attack path is straightforward and does not require elevated system privileges.