Pydio Cells combines identity, file storage, workspaces, OAuth clients, and public sharing. A person who reaches the login page may be blocked before seeing any files, while a leaked personal access token or public link may bypass the browser flow entirely. An exposure assessment that only records the login page leaves the important paths out.

On 2026-11-08, ZoomEye count-only observations returned 0 matches for app="Pydio Cells", 1,470 for title="Pydio Cells", and 2,397 for http.body="Pydio Cells". The query scope was sub_type=all, page 1, and page size 1. The title and body counts are close enough to be useful leads, but neither proves that a host is configured with public shares or weak tokens.

Personal access tokens are delegated authority

Pydio documents personal access tokens as an alternative to the standard OAuth flow. A token can replace a bearer access token when calling the REST API. It can also be restricted to a specific node with a scope in the form node:NODE_UUID:PERMISSION, where the permission can include read or write.

That scope is useful only when it is applied to the right node and the underlying user still has access to that node. The token should not be treated as an independent grant of filesystem authority. If the user is removed from a workspace or loses a role, the token should lose the effective access as well. Review both the token's scope and the roles that determine the user's workspace ACLs.

Workspaces and shares are different paths

Workspaces define which data a user can see through the application. Public links and shares can expose selected data to people who do not have a Cells account. The sharing model may include link permissions and visibility settings. Each share is a capability that should have an owner, a purpose, an expiration where supported, and a revocation path.

Inventory links that are reachable without authentication, including links that are unlisted rather than indexed. A link that does not appear in search results is still reachable by anyone who receives it. Check whether the link grants read only, write, or upload permission and whether the underlying workspace changed after the link was created.

A practical audit

Start from the public host and identify the OAuth, API, and share routes. Confirm that anonymous users can reach only the intended login or share surfaces. Test an API token in a separate test account and verify that it cannot read a workspace the account is not assigned to.

Review user roles, group membership, workspace ACLs, and administrator roles. Then list active personal access tokens by owner and creation date. Revoke tokens that have no owner or no documented consumer. Rotate secrets that were stored in CI logs, browser storage, or public repositories.

For shares, record the creator, target node, permission, and expiration. Test a link after removing the creator's access. Decide whether the link should continue as an independent capability or fail with the user. That policy should be explicit.

Search: ZoomEye title matches for Pydio Cells

Pydio's value comes from flexible delegation. The security work is to inventory every delegation separately: the OAuth client, the personal token, the workspace ACL, and the public share.

References