Authorization Bypass in Dromara Free-FS Enables Unrestricted Access

CVE-2026-129164

What is CVE-2026-129164?

The Dromara Free-FS versions 2.0.1 through 2.3.1 are susceptible to an authorization bypass vulnerability that allows unauthorized users to access protected shares. Due to client-side enforcement of share codes, an attacker who knows the share ID can easily list and download files, even if they are supposed to be restricted to preview-only access. This loophole in security can lead to unintended access to sensitive data, making it imperative for users of the affected versions to implement necessary security patches and updates to safeguard against potential exploitation.

References