{"id":"GHSA-h5fq-653g-gxrm","aliases":["GO-2026-5413"],"status":"published","title":"ots has a negative expire override that can bypass its secret retention policy","description":"## Summary\n\nThe `/api/create` endpoint accepted negative `expire` query values. For the memory storage backend, negative values were passed to secret creation as a negative duration and treated as no expiry, allowing callers to create secrets that persisted longer than intended.\n\n## Impact\n\nUnauthenticated users could bypass configured retention expectations for secrets they create by sending `POST /api/create?expire=-1`.\n\nThis does not allow reading or modifying secrets created by other users. Secrets remain one-time-read and, in the normal web flow, client-side encrypted.\n\n## Affected versions\n\nVersions up to and including v1.21.4 are affected.\n\n## Patched versions\n\nFixed in v1.21.5.\n\n## Workarounds\n\nDisable expiry overrides via `disableExpiryOverride: true` until upgrading.\n\n## Credit\n\nReported by Chai Cheng Xun via email.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2026-05-05T17:20:36Z","modified":"2026-07-21T14:49:20Z","fixes":[{"ecosystem":"Go","package":"github.com/Luzifer/ots","fixed_in":["1.21.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/Luzifer/ots","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.21.4"},{"fixed":"1.21.5"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/Luzifer/ots","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.21.5"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/Luzifer/ots","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.21.5"}]}]}],"references":[{"url":"https://github.com/Luzifer/ots/security/advisories/GHSA-h5fq-653g-gxrm","tags":["web","advisory"]},{"url":"https://github.com/Luzifer/ots/commit/3511bd18a2bec75bd9c6b4d513f2a90ccf4209b7","tags":["web","fix"]},{"url":"https://github.com/Luzifer/ots/releases/tag/v1.21.5","tags":["web"]},{"url":"https://github.com/advisories/GHSA-h5fq-653g-gxrm"},{"url":"https://github.com/Luzifer/ots","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-h5fq-653g-gxrm","title":"ots has a negative expire override that can bypass its secret retention policy","description":"## Summary\n\nThe `/api/create` endpoint accepted negative `expire` query values. For the memory storage backend, negative values were passed to secret creation as a negative duration and treated as no expiry, allowing callers to create secrets that persisted longer than intended.\n\n## Impact\n\nUnauthenticated users could bypass configured retention expectations for secrets they create by sending `POST /api/create?expire=-1`.\n\nThis does not allow reading or modifying secrets created by other users. Secrets remain one-time-read and, in the normal web flow, client-side encrypted.\n\n## Affected versions\n\nVersions up to and including v1.21.4 are affected.\n\n## Patched versions\n\nFixed in v1.21.5.\n\n## Workarounds\n\nDisable expiry overrides via `disableExpiryOverride: true` until upgrading.\n\n## Credit\n\nReported by Chai Cheng Xun via email.","status":"published","published":"2026-05-05T17:20:36Z","modified":"2026-05-05T17:20:37Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:40:00.970271Z"}],"osv":[{"id":"GHSA-h5fq-653g-gxrm","title":"ots has a negative expire override that can bypass its secret retention policy","description":"## Summary\n\nThe `/api/create` endpoint accepted negative `expire` query values. For the memory storage backend, negative values were passed to secret creation as a negative duration and treated as no expiry, allowing callers to create secrets that persisted longer than intended.\n\n## Impact\n\nUnauthenticated users could bypass configured retention expectations for secrets they create by sending `POST /api/create?expire=-1`.\n\nThis does not allow reading or modifying secrets created by other users. Secrets remain one-time-read and, in the normal web flow, client-side encrypted.\n\n## Affected versions\n\nVersions up to and including v1.21.4 are affected.\n\n## Patched versions\n\nFixed in v1.21.5.\n\n## Workarounds\n\nDisable expiry overrides via `disableExpiryOverride: true` until upgrading.\n\n## Credit\n\nReported by Chai Cheng Xun via email.","status":"published","published":"2026-05-05T17:20:36Z","modified":"2026-07-21T14:49:20Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:48.546324Z"},{"id":"GO-2026-5413","title":"ots has a negative expire override that can bypass its secret retention policy in github.com/Luzifer/ots","description":"ots has a negative expire override that can bypass its secret retention policy in github.com/Luzifer/ots","status":"published","published":"2026-06-25T22:34:31Z","modified":"2026-06-25T23:00:16.329686673Z","updated_at":"2026-11-02T15:47:02.556545Z"}]}}