Executive brief
A security flaw was identified in the linqi application's content delivery system that allows unauthorized users to bypass file access controls. By providing a specific 256-character parameter, an attacker can access files without proper authentication. However, the actual risk is minimal because the only files accessible through this flaw are public website styling and script files that do not contain sensitive customer data.
Technical details
An improper authentication vulnerability exists within the ValidateAnonFileAccess function of the linqi /api/Cdn/GetFile endpoint. The function incorrectly grants access to files if the 'AnonFile' query parameter contains exactly 256 characters, regardless of the actual credentials or token validity. This allows a remote, unauthenticated attacker to bypass intended access controls via a crafted network request. Despite the bypass, the impact is limited as the endpoint only serves minified static assets (JS and CSS) that are already publicly accessible via standard CDN routes. The vulnerability is tracked as CWE-287.
Affected products
- linqi linqi
Timeline
- 2026-06-05: advisory: CVE-2026-11345 published by linqi