CVE-2026-125362

Seahub through 14.0.10 Predictable Share Link Passwords via Batch Endpoint

2.3 Low

Seahub through 14.0.10 contains a weak randomness vulnerability in MultiShareLinksBatch.post() that generates batch share link passwords using Python's non-cryptographic random.choices(). Authenticated users permitted to create share links can request many generated passwords via the multi-share-links batch endpoint, recover the Mersenne Twister state, and predict other users' share link passwords.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

Exploit likelihood

0.26%Unchanged since Nov 10, 2026

What each source reports

CVE List Score used2.3

Seahub through 14.0.10 Predictable Share Link Passwords via Batch Endpoint

Record: CVE-2026-125362
CVSS 4.0: 2.3 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-338
Updated: 2026-11-10

EUVDEUVD-2026-1205252.3

Record: EUVD-2026-120525
CVSS 4.0: 2.3 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Updated: 2026-11-10

GitHub AdvisoriesGHSA-6jc7-hvrq-rjqm2.3

Seahub through 14.0.10 contains a weak randomness vulnerability in MultiShareLinksBatch.post()...

Record: GHSA-6jc7-hvrq-rjqm
CVSS 4.0: 2.3 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-338
Updated: 2026-11-10

NVD2.3

Record: CVE-2026-125362
CVSS 4.0: 2.3 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-338
Updated: 2026-11-10

OSV2.3

Seahub through 14.0.10 Predictable Share Link Passwords via Batch Endpoint

Record: CVE-2026-125362
CVSS 4.0: 2.3 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness: CWE-338
Updated: 2026-11-11

Affected products

haiwen seahub

History

History
Recorded	Changed	Sources
Nov 10, 2026	references	NVD, OSV
Nov 10, 2026	published	EUVD
Nov 10, 2026	aliases, references	GitHub Advisories
Nov 10, 2026	cwes, references, severity, title	CVE List
Nov 10, 2026	first indexed	EUVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-125362 is a low vulnerability (CVSS 2.3) in Haiwen Seahub, published November 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 17th percentile. No source names a fixed version.