Authentication Flaw in FileRise File Manager by Error311
CVE-2026-69191

5.4MEDIUM

Key Information:

Vendor

Error311

Status
Filerise
Vendor
CVE Published:
14 October 2026

What is CVE-2026-69191?

FileRise, a self-hosted web-based file manager, has a security flaw affecting its authentication mechanisms. Although functionalities like disableFormLogin, disableBasicAuth, and disableOIDCLogin are designed to protect the client interface, inconsistencies in server-side implementation allow users with valid credentials for disabled methods to bypass intended restrictions. By directly interacting with backend endpoints, these users can authenticate against the login-policy set by administrators. This issue does not permit authentication without valid credentials. The vulnerability has been addressed in version 3.21.0, which reinforces the proper enforcement of login methods.

Affected Version(s)

FileRise < 3.21.0

References

https://github.com/error311/FileRise/security/advisories/...
x_refsource_CONFIRM
https://github.com/error311/FileRise/commit/613fdb28ca25e...
x_refsource_MISC
https://github.com/error311/FileRise/releases/tag/v3.21.0
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.