CVE-2026-126936
MEDIUM
NVD
CVSS Score
5.9
Severity
MEDIUM
Published
Nov 13, 2026
Vendor
unknown
Description
Zipline before 4.7.0 contains a race condition vulnerability that allows users to bypass invitation usage limits, upload storage quotas, and shortened-URL quotas through concurrent requests. Attackers can send overlapping registration, upload, or URL creation requests that pass checks against stale state, creating extra accounts and exceeding administrator-configured resource quotas.