{"action":"Upgrade github.com/drakkan/sftpgo/v2 to 2.6.1 or later.","affected":[{"fixed":"2.6.1","introduced":"2.2.0"}],"component":"github.com/drakkan/sftpgo/v2","cve_ids":["CVE-2024-37897"],"ecosystem":"Go","epss":0.0031,"exploited":false,"fixed_versions":["2.6.1"],"ghsa_id":"GHSA-hw5f-6wvv-xcrh","id":"tcs_01M5KFD499ZRNQ9D865D2NS7Z6","modified_at":"2026-09-10T03:50:15.638617984Z","published_at":"2024-06-20T16:11:48Z","references":["https://osv.dev/vulnerability/GHSA-hw5f-6wvv-xcrh","https://github.com/drakkan/sftpgo/security/advisories/GHSA-hw5f-6wvv-xcrh","https://nvd.nist.gov/vuln/detail/CVE-2024-37897","https://github.com/drakkan/sftpgo/commit/1f8ac8bfe16100b0484d6c91e1e8361687324423","https://github.com/drakkan/sftpgo/commit/3462bba3f41cbc75486474991b9e3ac1b5f1e583","https://github.com/drakkan/sftpgo","https://github.com/drakkan/sftpgo/releases/tag/v2.6.1"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-hw5f-6wvv-xcrh","url":"https://osv.dev/vulnerability/GHSA-hw5f-6wvv-xcrh"}],"summary":"SFTPGo has insufficient access control for password reset"}