CVE-2026-69191

Deferred Deferred - Pending Action

Authentication Bypass in FileRise via Disabled Login Methods

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.21.0, FileRise enforces disableFormLogin, disableBasicAuth, and disableOIDCLogin in the client interface but not consistently in the corresponding server-side authentication flows. A user with otherwise valid credentials for a disabled method can call its backend endpoint directly and authenticate despite the administrator's login-method policy. The flaw does not permit credential-free authentication. This issue is fixed in version 3.21.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-69191

Affected Vendors & Products

Vendor	Product	Version / Range
error311	FileRise	< 3.21.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

FileRise is a self-hosted file manager. Prior to version 3.21.0, it had inconsistent enforcement of disabled login methods. While the client interface blocked disabled login methods like disableFormLogin, the server-side authentication flows did not enforce these restrictions. This allowed users with valid credentials for a disabled method to bypass the policy by directly calling backend endpoints.

Detection Guidance

To detect this vulnerability, check if FileRise versions prior to 3.21.0 are running. Inspect server-side authentication flows for disabled login methods (disableFormLogin, disableBasicAuth, disableOIDCLogin) that may still be accessible via direct endpoint calls. Verify if users with valid credentials for disabled methods can authenticate through backend endpoints despite policy settings.

Impact Analysis

If you use FileRise versions before 3.21.0, an attacker with valid credentials for a disabled login method could authenticate despite the administrator disabling that method. This could lead to unauthorized access to files or system functions, depending on the disabled method's permissions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements such as GDPR or HIPAA. Unauthorized access risks data breaches, potentially resulting in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Update FileRise to version 3.21.0 or later to ensure server-side authentication flows enforce the disabled login methods consistently.

Hi! I’m here to help you understand CVE-2026-69191. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70