Diced
CVE-2026-126936: Zipline before 4.7.0 contains a race condition vulnerability that allows users to bypass invitation usage limits, upload storage quotas, and shortened-URL quota
CVE-2026-126936 Nov 13, 2026 Source: Vendor
Zipline before 4.7.0 contains a race condition vulnerability that allows users to bypass invitation usage limits, upload storage quotas, and shortened-URL quotas through concurrent requests. Attackers can send overlapping registration, upload, or URL creation requests that pass checks against stale state, creating extra accounts and exceeding administrator-configured resource quotas.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://nvd.nist.gov/vuln/detail/CVE-2026-126936
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
1 line
Showing 1–1 of 1
CVE-2026-126936
BR2026-0000-048296
unclaimed
Credited as tonghuaroot