CVE-2025-71460
MEDIUM
NVD
CVSS Score
4.2
Severity
MEDIUM
Published
Nov 13, 2026
Vendor
unknown
Description
Zipline before 4.2.1 contains a missing authorization vulnerability in the /api/user/files/transaction endpoint that allows authenticated users to modify other users' files due to absent ownership checks. Attackers who know a target file ID can submit transaction requests to edit or delete files belonging to any user.