Gokapi, a self-hosted file sharing server, has a CSRF vulnerability in its login endpoint that allows an attacker to create an authenticated session without the victim’s knowledge. The flaw arises because the server accepts credential-bearing requests during the login flow without tying them to a browser session or CSRF token. Successfully exploited, this weakness can lead to unauthorized access to the attacker’s account or a session that can be used to hijack subsequent operations. The weakness is categorized as CWE‑352, a form of input validation and context‑sensitive attack.

All deployments of Gokapi versions earlier than 2.2.3 are susceptible to this issue. The affected product is Forceu Gokapi as listed by the CNA, and any installation using any release older than 2.2.3 is impacted. The vulnerability is mitigated in the 2.2.3 release and later.

The CVSS base score of 4.6 indicates a moderate degree of risk, and the EPSS score of less than 1 % reflects a very low likelihood of exploitation in the wild. The vulnerability is not yet listed in the CISA KEV catalogue. Attackers can exploit it via a crafted CSRF request sent from a compromised or malicious web page that a victim visits, exploiting the browser’s cross‑origin request capability. No special prerequisites beyond user interaction are required, making the attack straightforward for a determined adversary.