Authentication Bypass Vulnerability in FileRise by Error311

CVE-2026-104108

What is CVE-2026-104108?

FileRise, a self-hosted web-based file manager, contains an authentication bypass vulnerability that affects versions prior to 3.23.0. The vulnerability arises from the improper handling of authenticated OIDC identities where mutable preferred_username or email claims can be manipulated. This allows an attacker to potentially log in as any user, including administrators, if they can obtain colliding claims from the identity provider. As a result, even when automatic provisioning is disabled, the system's security can be compromised. Users are advised to upgrade to version 3.23.0 or later to mitigate this risk.

References