---
id: CVE-2026-58272
title: >-
  Sync-in Server is an open-source platform for file storage, sharing,
  collaboration, and syncing
summary: >-
  Sync-in Server is an open-source platform for file storage, sharing,
  collaboration, and syncing. Versions prior to 2.4.1 contain an observable
  timing discrepancy in the login endpoint because authentication attempts for
  nonexistent accou…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-208
vendor: Sync-in
product: server
affected:
  - server < 2.4.1
patched:
  - '@sync-in/server 2.4.1'
published: '2026-09-21'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T20:17:11.793'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-58272'
references:
  - url: 'https://github.com/Sync-in/server/security/advisories/GHSA-29hq-23m2-2j47'
    label: security-advisories@github.com
  - url: 'https://github.com/Sync-in/server/security/advisories/GHSA-29hq-23m2-2j47'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-58272'
  - url: >-
      https://github.com/Sync-in/server/commit/b80efe04574039a7a302c0e1007f03a7dbe6a633
  - url: 'https://github.com/Sync-in/server/releases/tag/v2.4.1'
  - url: 'https://github.com/advisories/GHSA-29hq-23m2-2j47'
tags:
  - nvd
  - cve.org
  - exploit-available
  - ghsa
  - npm
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-23T19:41:58.798280Z'
epss: 0.00342
epssPercentile: 0.24983
aliases:
  - GHSA-29hq-23m2-2j47
ecosystem: npm
ingestedAt: '2026-09-21T20:52:58.298Z'
---

## Overview

Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Versions prior to 2.4.1 contain an observable timing discrepancy in the login endpoint because authentication attempts for nonexistent accounts return without performing the bcrypt comparison used for existing accounts. An unauthenticated attacker can measure response times to enumerate valid usernames or email addresses, facilitating credential-stuffing, password-spraying, and phishing attacks. Version 2.4.1 contains a patch.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-58272)

Affected packages:

- `@sync-in/server <= 2.4.0`

Patched in:

- `@sync-in/server 2.4.1`

Source: https://github.com/advisories/GHSA-29hq-23m2-2j47