CVE-2026-104106

Deferred Deferred - Pending Action

Authenticated Session Bypass in FileRise via TOTP Enrollment

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise permits an authenticated session with a valid CSRF token to disable TOTP without recent full reauthentication or to begin enrollment when the account currently has no TOTP secret. The enrollment endpoint returns 409 rather than directly overwriting an already configured secret, but it persists and activates a newly generated secret before a TOTP code verifies possession. An attacker controlling an existing authenticated session can therefore disable an existing second factor or enroll one after the account has no configured secret; this is not a direct overwrite of an active authenticator. This issue is fixed in version 3.23.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-104106

Affected Vendors & Products

Vendor	Product	Version / Range
error311	FileRise	< 3.23.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-620	When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.

Attack-Flow Graph

Executive Summary

FileRise before version 3.23.0 has an issue where an authenticated user with a valid CSRF token can disable TOTP (two-factor authentication) without needing to reauthenticate fully. If the account has no TOTP secret, an attacker can also enroll a new TOTP secret. The system returns a 409 error if TOTP is already configured but still activates the new secret before verification, allowing unauthorized access.

Detection Guidance

This vulnerability requires checking FileRise application logs for suspicious TOTP enrollment or disable actions. Look for POST requests to /api/totp endpoints without subsequent verification. No specific commands are provided in the context.

Impact Analysis

If you use FileRise before version 3.23.0, an attacker with access to your authenticated session could disable your two-factor authentication or enroll a new one without your knowledge. This could allow them to gain control of your account even if you had TOTP enabled.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (data protection) or HIPAA (health information security). Organizations using affected versions risk non-compliance due to insufficient authentication controls.

Mitigation Strategies

Upgrade FileRise to version 3.23.0 or later to address the vulnerability.
Review and monitor user accounts for unauthorized TOTP changes or enrollments.
Ensure all authenticated sessions are re-authenticated after the upgrade.

Hi! I’m here to help you understand CVE-2026-104106. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70