CVE-2026-69193

Deferred Deferred - Pending Action

Password Spraying Bypass in FileRise

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.21.0, FileRise tracks failed logins only by the combination of source IP address and username. A remote unauthenticated attacker can rotate usernames to obtain a fresh per-account attempt budget for each name, enabling password spraying from one source beyond the intended limit. Per-user limits still apply and can also produce distinguishable throttling behavior for targeted accounts. The affected surface is AuthModel::getFailedLoginKey(). This issue is fixed in version 3.21.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-69193

Affected Vendors & Products

Vendor	Product	Version / Range
error311	FileRise	< 3.21.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-307	The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Attack-Flow Graph

Executive Summary

FileRise before version 3.21.0 tracks failed logins only by source IP and username combination. An attacker can bypass rate limits by rotating usernames, allowing password spraying attacks from a single source IP beyond intended restrictions. The issue is in AuthModel::getFailedLoginKey().

Detection Guidance

Monitor for repeated failed login attempts from a single IP address with varying usernames, as this may indicate password spraying attempts exploiting CVE-2026-69193. Check FileRise logs for unusual authentication patterns where the same source IP uses multiple usernames in quick succession.

Impact Analysis

An attacker could exploit this to perform password spraying attacks, increasing the chance of guessing valid credentials. This could lead to unauthorized access to user accounts if weak passwords are used.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized access attempts through password spraying. Weak authentication controls may violate data protection requirements for secure access to sensitive data.

Mitigation Strategies

Upgrade FileRise to version 3.21.0 or later to address the vulnerability. Implement account lockout policies after a set number of failed attempts and enforce strong password requirements to reduce the risk of successful password spraying attacks.

Hi! I’m here to help you understand CVE-2026-69193. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70