An insufficient authorization check in Gokapi's file replace API allows an authenticated user with only list visibility permission (UserPermListOtherUploads) to delete files owned by other users by setting the deleteNewFile flag. This privilege escalation leads to unauthorized data deletion, affecting confidentiality and availability of stored files. The vulnerability is identified by CWE-863.

All versions of Forceu Gokapi older than 2.2.4 are affected. The vulnerability is present in Gokapi releases prior to v2.2.4, as indicated in the Forceu advisory and the GitHub release notes. The affected product is listed under the CPE string cpe:2.3:a:forceu:gokapi:*:*:*:*:*:*:*:* and is used as a self‑hosted file sharing server.

The CVSS base score is 4.1, indicating low severity. EPSS score is less than 1 % and the vulnerability is not listed in CISA's KEV catalog, suggesting a low likelihood of exploitation in the wild. The attack vector requires authentication to the API and permission to list uploads; an attacker can exploit this by sending a crafted request to the file replace endpoint with deleteNewFile set to true. No public exploits have been reported, but administrators should still mitigate by updating.