The vulnerability lies in the server‑side event (SSE) implementation used to stream upload status to any authenticated client. The stream publishes a global set of upload records, including the identifier of every file in the system, regardless of the requesting user’s ownership. A logged‑in attacker or a benign user could therefore observe file identifiers belonging to other users, potentially revealing the existence of files they should not access. This flaw is a classic information‑disclosure weakness and also violates proper access control, as evidenced by the CWE‑200 and CWE‑284 classifications.

Any installation of Forceu Gokapi that runs a version earlier than 2.2.3 is affected. The vulnerability became known after release of v2.2.3 and is absent in all later releases. No other products or vendors are listed as affected.

The CVSS score of 6.4 indicates moderate severity. The EPSS score is reported as less than 1%, implying that exploitation is unlikely at this time, and the vulnerability is not present in CISA’s Known Exploited Vulnerabilities catalog. However, because the attack requires an authenticated session, an attacker could leverage this to enumerate files among users of a shared deployment, which can assist in planning further attacks or in data exfiltration. The risk is therefore moderate but mitigated by the low likelihood of public exploitation.