CVE-2026-69191 Details
Description
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.21.0, FileRise enforces disableFormLogin, disableBasicAuth, and disableOIDCLogin in the client interface but not consistently in the corresponding server-side authentication flows. A user with otherwise valid credentials for a disabled method can call its backend endpoint directly and authenticate despite the administrator's login-method policy. The flaw does not permit credential-free authentication. This issue is fixed in version 3.21.0.
A vulnerability exists in FileRise, a self-hosted web-based file manager, allowing users to bypass disabled login method restrictions. Prior to version 3.21.0, the application enforced login method restrictions only on the client side, leaving a gap that could be exploited by sending direct API requests to backend endpoints for methods that had been disabled. This issue does not allow authentication without valid credentials, but it undermines the administrator's login policy, potentially leading to unauthorized access.
Users should upgrade to FileRise version 3.21.0 or later, where this vulnerability has been fixed. After upgrading, verify that any disabled login methods are correctly enforced on the server side.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/error311/FileRise/commit/613fdb28ca25e6dcc9bdfa590757b53935fad8da | [email protected] | Source CodeVendor |
| https://github.com/error311/FileRise/releases/tag/v3.21.0 | [email protected] | Release NotesVendor |
| https://github.com/error311/FileRise/security/advisories/GHSA-p9qc-2r93-jccq | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FileRise | <= 3.20.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |