CVE-2026-57493 Details
Description
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise stores the isAdmin flag in remember-me tokens and restores that stale value during automatic login instead of resolving the account's current role from users.txt. A user who was issued a token while an administrator can retain administrator access after demotion, and token rotation copies the stale privilege into each replacement token. Exploitation requires possession of the pre-demotion remember-me token. This issue is fixed in version 3.16.0.
A vulnerability in FileRise prior to version 3.16.0 allows users to retain admin privileges through stale remember-me tokens. The issue arises because the isAdmin flag is stored in the token and automatically restored during login, without checking the user's current role. As a result, a user who was an admin when the token was issued can continue to have admin access after being demoted. This vulnerability can be exploited by anyone with a valid remember-me token from a previous admin session.
Users can upgrade to FileRise version 3.16.0 or later, where this vulnerability has been fixed. Instructions for downloading the latest version are available on the FileRise GitHub releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/error311/FileRise/security/advisories/GHSA-r55g-3hcc-6jx7 | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/error311/FileRise/commit/f7114ca2a4e624238dda0d097a07ad6b05c11bb6 | [email protected] | Source CodeVendor |
| https://github.com/error311/FileRise/releases/tag/v3.16.0 | [email protected] | Release NotesVendor |
| https://github.com/error311/FileRise/security/advisories/GHSA-r55g-3hcc-6jx7 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-613 | Insufficient Session Expiration | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| error311/FileRise | <= 3.15.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |