CVE-2026-57493

Deferred Deferred - Pending Action

Privilege Escalation via Stale Admin Token in FileRise

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: GitHub, Inc.

Description

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise stores the isAdmin flag in remember-me tokens and restores that stale value during automatic login instead of resolving the account's current role from users.txt. A user who was issued a token while an administrator can retain administrator access after demotion, and token rotation copies the stale privilege into each replacement token. Exploitation requires possession of the pre-demotion remember-me token. This issue is fixed in version 3.16.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-57493

Affected Vendors & Products

Vendor	Product	Version / Range
error311	FileRise	< 3.16.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-613	According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

Executive Summary

FileRise before version 3.16.0 stores the administrator privilege flag in remember-me tokens. When a user is demoted from admin to regular user, the system fails to update the token to reflect this change. Instead, it restores the stale admin flag during automatic login, allowing the user to retain admin access indefinitely. Token rotation also copies this incorrect privilege level into new tokens.

Detection Guidance

Check FileRise version for versions prior to 3.16.0. Inspect remember-me tokens for the isAdmin flag stored in them. Verify if demoted users retain admin access after token rotation.

Impact Analysis

If you were previously an administrator and received a remember-me token before being demoted, an attacker with access to that token could gain and maintain admin privileges even after demotion. This could lead to unauthorized file access, modification, or deletion, and potential system compromise.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and regular privilege reviews. Unauthorized admin access may lead to data breaches, unauthorized data processing, or improper access to sensitive files, which could result in violations of GDPR, HIPAA, or other regulatory frameworks.

Mitigation Strategies

Upgrade FileRise to version 3.16.0 or later. Invalidate all existing remember-me tokens and force users to re-authenticate. Review user roles in users.txt to ensure no stale admin privileges remain.

Hi! I’m here to help you understand CVE-2026-57493. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70