CVE-2026-72839

Received Received - Intake

Filebrowser Unauthenticated Privilege Escalation via Default Scope Misconfiguration

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: VulnCheck

Description

filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is enabled with default CreateUserDir setting. Unauthenticated attackers can register accounts that inherit the server root scope with full create, modify, delete, rename, share, and download permissions, allowing unrestricted access to all files.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-72839

EUVD

EUVD-2026-58547

Affected Vendors & Products

Vendor	Product	Version / Range
filebrowser	filebrowser	to 2.63.16 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-266	A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

filebrowser through version 2.63.16 has a flaw where self-signup with default CreateUserDir setting fails to restrict scope and permissions. Unauthenticated attackers can register accounts that gain root-level access with full permissions including file creation, modification, deletion, renaming, sharing, and downloading.

Detection Guidance

Check if filebrowser is running with self-signup enabled and default CreateUserDir setting. Inspect server logs for unauthorized account registrations or unusual file access patterns. Verify user permissions and scope inheritance for newly created accounts.

Impact Analysis

This vulnerability allows attackers to gain complete control over the filebrowser server. They can access, modify, delete, or exfiltrate any files stored on the system without authentication. This could lead to data theft, data corruption, unauthorized file uploads, or complete system compromise.

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA due to unauthorized access to sensitive data. GDPR requires protection against unauthorized access to personal data, while HIPAA mandates strict access controls for protected health information. The breach could result in regulatory fines and legal consequences.

Mitigation Strategies

Disable self-signup in filebrowser configuration. Set CreateUserDir to false to prevent unauthorized directory creation. Review and restrict user permissions to minimum required access. Update filebrowser to the latest patched version if available.

Hi! I’m here to help you understand CVE-2026-72839. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70