What it is
An authenticated user can bypass a Permission Override by addressing the protected folder with different capitalization or its Windows 8.3 short name.
Affected versions
Versions 4.0.0 through 8.7.1, Windows only.
The advisory states “all versions before 8.8.0”; that is inaccurate and we have asked VulnCheck to correct it. Linux is not affected.
Are you exposed?
Only if you run Windows and at least one of your users has Permission Overrides configured. If not, this does not apply to you.
Fix
Upgrade to v8.8.0 (released October 25, 2026).
Can’t upgrade yet? Do this:
Move each folder that needs different permissions out of the user’s home folder, to a separate location on disk.
Mount it in the user’s namespace as a Virtual Folder, with the permissions it needs. Virtual Folders are not affected by this bug.
Remove the corresponding Permission Overrides.
Removing the overrides alone is not a mitigation: step 1 and 2 are what protect the data.
Advisory: https://www.vulncheck.com/advisories/syncplify-server-permission-override-bypass-via-path-casing