CVE-2026-104108

Deferred Deferred - Pending Action

Authentication Bypass in FileRise via Claim Collision

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: GitHub, Inc.

Description

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise maps an authenticated OIDC identity to a local account using mutable preferred_username or email claims and does not require email_verified for email-based naming. An attacker who can obtain provider-issued claims colliding with an existing local username can be logged in as that account, including the built-in administrator, even when automatic provisioning is disabled. Exploitability depends on the configured identity provider allowing the colliding claim. This issue is fixed in version 3.23.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-104108

Affected Vendors & Products

Vendor	Product	Version / Range
error311	FileRise	< 3.23.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
CWE-290	This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

Executive Summary

FileRise before version 3.23.0 has a vulnerability where an attacker can exploit OIDC identity mapping to log in as another user, including the built-in administrator. This happens because the system uses mutable preferred_username or email claims for account mapping without requiring email_verified for email-based naming. If the identity provider allows claim collisions with existing usernames, the attacker gains unauthorized access.

Detection Guidance

Detecting this vulnerability requires checking the FileRise version and OIDC configuration. Verify if your FileRise instance is running version 3.23.0 or later. Check OIDC claim mappings for mutable preferred_username or email fields without email_verified enforcement.

Impact Analysis

This vulnerability allows an attacker to impersonate any user, including administrators, potentially gaining full control over the FileRise instance. This could lead to unauthorized file access, data theft, modification, or deletion. The impact depends on the attacker's goals and the permissions of the impersonated account.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches, non-compliance with access control policies, and failure to protect personal health or user information, potentially leading to legal penalties and reputational damage.

Mitigation Strategies

Upgrade FileRise to version 3.23.0 or later immediately. Review OIDC provider settings to ensure email_verified is required and claims cannot collide with existing usernames. Disable automatic provisioning if not needed.

Hi! I’m here to help you understand CVE-2026-104108. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70