Improper Authorization Flaw in FileRise Affects Web-Based File Manager

CVE-2026-103988

What is CVE-2026-103988?

The vulnerability in FileRise prior to version 3.23.0 allows users with authenticated access to bypass folder-scoped permissions when renaming a folder. An attacker can move a source folder to a destination that belongs to another user or to the root namespace, effectively rekeying the ownership and Access Control List (ACL) records. This flaw stems from insufficient validation against the target destination parent folder, which can lead to unauthorized access. The problem is mitigated in version 3.23.0, which incorporates enhanced authorization checks for folder management operations.

References