The vulnerability is an authentication bypass in SeaHub’s ShareLinkZipTaskView GET method, which fails to enforce the SHARE_LINK_LOGIN_REQUIRED policy. An attacker possessing a folder share‑link token can issue a GET request to /api/v2.1/share-link-zip-task/ and receive a ZIP token, enabling download of the entire shared directory tree. This flaw belongs to CWE-862: Authorization Boundary Defect and results in unauthorized disclosure of potentially sensitive files.

The affected product is SeaHub by Haiwen. All versions prior to 13.0.23 are vulnerable. No other products or versions are listed by the CNA.

The CVSS vector scores the flaw as 8.7, indicating high severity. Although the EPSS score is unavailable and the vulnerability is not catalogued in CISA KEV, the lack of authentication guard and the ability to download arbitrary directories make exploitation straightforward over the network. Attackers must hold a valid shared‑link token, but once obtained they can bypass authentication and exfiltrate data from any accessible directory tree.