← Vulnerability feed

Vulnerability record · CVE-2021-43820 · published 14 December 2021

CVE-2021-43820: Seafile server insecure direct object reference vulnerability

Seafile · Seafile Server

Seafile is an open source cloud storage system. A sync token is used in Seafile file syncing protocol to authorize access to library data. To improve performance, the token is cached in memory in seaf-server. Upon receiving a token from sync client or SeaDrive client, the server checks whether the token exist in the cache. However, if the token exists in cache, the server doesn't check whether it's associated with the specific library in the URL. This vulnerability makes it possible to use any valid sync token to access data from any **known** library. Note that the attacker has to first find out the ID of a library which it has no access to. The library ID is a random UUID, which is not possible to be guessed. There are no workarounds for this issue.

5.9 CVSS 3.1 Medium EPSS 0.96% · top 39.9% CWE-639 · Insecure direct object reference
5.9CVSS 3.1 base score, v2 4.3
0.96%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

Seafile is an open source cloud storage system. A sync token is used in Seafile file syncing protocol to authorize access to library data. To improve performance, the token is cached in memory in seaf-server. Upon receiving a token from sync client or SeaDrive client, the server checks whether the token exist in the cache. However, if the token exists in cache, the server doesn't check whether it's associated with the specific library in the URL. This vulnerability makes it possible to use any valid sync token to access data from any **known** library. Note that the attacker has to first find out the ID of a library which it has no access to. The library ID is a random UUID, which is not possible to be guessed. There are no workarounds for this issue.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/haiwen/seafile-server/pull/520 PatchThird Party Advisory
https://github.com/haiwen/seafile-server/security/advisories/GHSA-m3wc-jv6r-hvv8 Third Party Advisory
https://github.com/haiwen/seafile-server/pull/520 PatchThird Party Advisory
https://github.com/haiwen/seafile-server/security/advisories/GHSA-m3wc-jv6r-hvv8 Third Party Advisory

Track CVE-2021-43820 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.7CVE-2026-30587Seafile server cross-site scripting vulnerabilityMultiple Stored XSS vulnerabilities exist in Seafile Server version 13.0.15,13.0.16-pro,12.0.14 and prior and fixed in 13.0.17, 13.0.17-pro, and 12.0…EPSS 0.46%7.8CVE-2014-5443Seafile server permissions and access controls vulnerabilitySeafile Server before 3.1.2 and Server Professional Edition before 3.1.0 allow local users to gain privileges via vectors related to ccnet handling u…EPSS 0.42%6.1CVE-2025-65516Seafile server cross-site scripting vulnerabilityA stored cross-site scripting (XSS) vulnerability was discovered in Seafile Community Edition prior to version 13.0.12. When Seafile is configured wi…EPSS 0.22%8.4CVE-2026-55255Langflow IDOR in responses endpoint allows cross-user flow executionLangflow before 1.9.1 has an insecure direct object reference in the /api/v1/responses endpoint. An authenticated attacker can supply another user's …KEVEPSS 0.89%analysed

Source: NIST National Vulnerability Database (record CVE-2021-43820), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.