Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-104108: FileRise lets attacker log in as existing account

CVE-2026-104108 · published 21 days ago

Summary

FileRise versions before 3.23.0 can link an external login to any local user if the external provider supplies a matching username or email. This means an attacker could gain access to accounts, including the admin, without needing email verification. Upgrade to version 3.23.0 or later to stop this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
error311	filerise	< 3.23.0

Original advisory text

FileRise OIDC login can bind an attacker identity to an existing local account

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise maps an authenticated OIDC identity to a local account using mutable preferred_username or email claims and does not require email_verified for email-based naming. An attacker who can obtain provider-issued claims colliding with an existing local username can be logged in as that account, including the built-in administrator, even when automatic provisioning is disabled. Exploitability depends on the configured identity provider allowing the colliding claim. This issue is fixed in version 3.23.0.

References

https://github.com/error311/FileRise/releases/tag/v3.23.0 URL
https://github.com/error311/FileRise/commit/cc1118923b522baff28dca05bdd79c27f984... Patch
https://github.com/error311/FileRise/security/advisories/GHSA-c5c5-mv9m-j367 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-1041... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-104108 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.1 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-287Improper Authentication

CWE-290Authentication Bypass by Spoofing

CWE-345Insufficient Verification of Data Authenticity

Timeline

Published14 Oct 2026

Updated4 Nov 2026

First seen14 Oct 2026

Sources

CVE-2026-104108 · NVD

CVE-2026-104108 · MITRE

CVE-2026-104108 · OSV

GHSA-c5c5-mv9m-j367 · GHSA

Track software like this

Free during beta