Remote Authentication Bypass in FileRise by Error311

CVE-2026-69193

What is CVE-2026-69193?

FileRise, a self-hosted web-based file manager, has a vulnerability where it tracks failed login attempts only by the combination of source IP address and username. This allows an unauthenticated remote attacker to rotate usernames and exploit the allowance of per-account attempt budgets uniquely provided for each username. Consequently, malicious actors can leverage this flaw to conduct password spraying attacks against targeted accounts, potentially bypassing login protections set for individual users. This issue has been resolved in version 3.21.0.

References