Session Management Flaw in FileRise Affected by Error311

CVE-2026-57493

What is CVE-2026-57493?

In versions prior to 3.16.0, FileRise, a self-hosted web-based file manager, experiences a flaw in its session management system. Specifically, the isAdmin flag is stored in remember-me tokens without checking the user's current role. As a result, an account that is downgraded from administrative privileges can still retain admin access if they possess a pre-demotion token. This vulnerability allows potential exploitation during automatic login, as stale privilege levels are inadvertently restored. Token rotation further complicates the issue by copying over existing privileges into replacement tokens. Users are encouraged to upgrade to version 3.16.0 to mitigate this risk.

References