CVE-2026-104108
8.1HighPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-287, CWE-290, CWE-345
Impact
Remote attackers can hijack existing local FileRise accounts, including the built-in administrator, leading to full data and server compromise. To pull this off, the attacker needs to obtain a token from your configured OIDC identity provider matching a target account's username or unverified email.
Root cause
FileRise maps incoming OIDC identities using mutable username or email claims without verifying the email_verified claim.
Affected systems
FileRise versions prior to 3.23.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade FileRise to version 3.23.0 or later. If upgrading immediately is not possible, disable OIDC login or restrict your identity provider from allowing arbitrary user-controlled email or username claims.
$ docker pull error311/filerise:v3.23.0AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise maps an authenticated OIDC identity to a local account using mutable preferred_username or email claims and does not require email_verified for email-based naming. An attacker who can obtain provider-issued claims colliding with an existing local username can be logged in as that account, including the built-in administrator, even when automatic provisioning is disabled. Exploitability depends on the configured identity provider allowing the colliding claim. This issue is fixed in version 3.23.0.