CVE-2026-32761
Permission Bypass in File Browser Allows Unauthorized File Exfiltration
Publication date: 2026-03-20
Last updated on: 2026-03-23
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| filebrowser | filebrowser | to 2.62.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a permission enforcement bypass in File Browser versions 2.61.0 and below. It allows users who do not have download privileges (perm.download = false) but do have share privileges (perm.share = true) to access and exfiltrate file content by creating public share links.
While the direct raw download endpoint correctly enforces download permissions, the share creation endpoint only checks for share permission. The public download handler serves file content without verifying if the original file owner has download permission. This means an authenticated user with share access can bypass download restrictions by sharing a file and then retrieving it via the unauthenticated public download URL.
This flaw undermines data-loss prevention and role-separation policies because restricted users can publicly distribute files they are explicitly blocked from downloading directly. The issue was fixed in version 2.62.0.
How can this vulnerability impact me? :
This vulnerability allows unauthorized data exfiltration by bypassing intended access controls. Any authenticated user with share privileges but without download privileges can access and publicly distribute files they should not be able to download.
- Unauthorized users can retrieve sensitive file contents via public share links.
- It breaks data loss prevention controls by allowing restricted users to leak files.
- It undermines role separation policies by allowing users to circumvent download restrictions.
- The vulnerability has a moderate severity with a CVSS v3 base score of 6.5.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by testing whether users with share privileges but without download privileges can access file contents via public share links.'}, {'type': 'list_item', 'content': 'Create a non-admin user with perm.share = true and perm.download = false.'}, {'type': 'list_item', 'content': 'Upload a file (e.g., a PDF) using this user.'}, {'type': 'list_item', 'content': "Attempt a direct raw download using a command like: curl -i -X GET https://<filebrowser-host>/api/raw/<filename> -H 'Authorization: Bearer <token>' (expected to be denied)."}, {'type': 'list_item', 'content': "Create a share link for the file using: curl -i -X POST https://<filebrowser-host>/api/share/<filename> -H 'Authorization: Bearer <token>'."}, {'type': 'list_item', 'content': 'Attempt to download the file publicly without authentication using: curl -i -X GET https://<filebrowser-host>/api/public/dl/<hash>.'}, {'type': 'paragraph', 'content': 'If the public download returns the file content (HTTP 200), the vulnerability is present.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation is to upgrade File Browser to version 2.62.0 or later, where the vulnerability has been fixed.
The fix enforces that users must have both share and download permissions to create share links, preventing unauthorized file exfiltration.
If upgrading immediately is not possible, consider restricting share privileges to only users who also have download permissions as a temporary workaround.
Monitor and audit share link creation and public downloads to detect any unauthorized access.