CVE-2026-104108 Details
Description
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise maps an authenticated OIDC identity to a local account using mutable preferred_username or email claims and does not require email_verified for email-based naming. An attacker who can obtain provider-issued claims colliding with an existing local username can be logged in as that account, including the built-in administrator, even when automatic provisioning is disabled. Exploitability depends on the configured identity provider allowing the colliding claim. This issue is fixed in version 3.23.0.
A vulnerability in FileRise, a self-hosted web-based file manager, allows for account takeover via OpenID Connect (OIDC) login. This issue affects versions prior to 3.23.0. The vulnerability arises because FileRise maps an authenticated OIDC identity to a local account using mutable, unverified claims such as 'preferred_username' or email, without requiring 'email_verified' validation for email-based identifiers. An attacker who can obtain provider-issued claims that collide with an existing local username can gain access to that account, including the built-in administrator account, even when automatic provisioning is disabled. The exploitability of this vulnerability depends on the configuration of the identity provider (IdP) used.
Upgrade to FileRise version 3.23.0, which binds OIDC identities to the immutable 'issuer' and 'subject' claims, requires 'email_verified' validation before matching by email, and includes a guided link process for existing OIDC accounts to ensure proper binding.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/error311/FileRise/security/advisories/GHSA-c5c5-mv9m-j367 | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/error311/FileRise/commit/cc1118923b522baff28dca05bdd79c27f984c68a | [email protected] | Source CodeVendor |
| https://github.com/error311/FileRise/releases/tag/v3.23.0 | [email protected] | Release NotesVendor |
| https://github.com/error311/FileRise/security/advisories/GHSA-c5c5-mv9m-j367 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
| CWE-290 | Authentication Bypass by Spoofing | [email protected] |
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FileRise | <= 3.22.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |