A vulnerability in Gokapi's user rank demotion logic allows a demoted user to retain certain API permissions tied to existing API keys. The permissions "ApiPermManageFileRequests" and "ApiPermManageLogs" remain active even after the user has been stripped of all privileges, giving the attacker continued access to upload‑request management and log viewing endpoints. This escalation could enable unauthorized configuration changes or access to sensitive data through the file sharing service.

Forceu Gokapi self‑hosted file sharing server. Versions prior to 2.2.3 are affected. The vulnerability occurs in all installations that have demoted users and have not applied the 2.2.3 release.

The vulnerability has a CVSS score of 5.4 and an EPSS score of less than 1%, indicating a moderate severity but low likelihood of exploitation. It is not listed in the CISA KEV catalog. Attackers would require a demoted user account that still retains an API key, which suggests the flaw is exploitable after legitimate role changes without additional privileges. The risk is primarily to users who are incorrectly allowed to maintain API access after demotion.