Unauthorized User Impersonation in File Browser by FileBrowser

CVE-2026-54089

What is CVE-2026-54089?

The File Browser application, starting from version 2.0.0-rc.1, contains a vulnerability that allows unauthenticated attackers to impersonate any user, including admins. This can be achieved by sending a specially crafted HTTP header when the application is configured with proxy authentication. Additionally, entering a non-existent username can lead to the automatic creation of a new user account on the server without any authorization checks. This long-standing issue has been documented but not formally classified as a vulnerability until now.

References