CVE-2026-104106

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise permits an authenticated session with a valid CSRF token to disable TOTP without recent full reauthentication or to begin enrollment when the account currently has no TOTP secret. The enrollment endpoint returns 409 rather than directly overwriting an already configured secret, but it persists and activates a newly generated secret before a TOTP code verifies possession. An attacker controlling an existing authenticated session can therefore disable an existing second factor or enroll one after the account has no configured secret; this is not a direct overwrite of an active authenticator. This issue is fixed in version 3.23.0.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/error311/FileRise/commit/cc1118923b522baff28dca05bdd79c27f984c68a
https://github.com/error311/FileRise/releases/tag/v3.23.0
https://github.com/error311/FileRise/security/advisories/GHSA-77m8-hm3q-mrr5

Configurations

No configuration.

History

14 Oct 2026, 21:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-14 21:17

Updated : 2026-10-15 16:17

NVD link : CVE-2026-104106

Mitre link : CVE-2026-104106

CVE.ORG link : CVE-2026-104106

JSON object : View

Products Affected

No product.

CWE

CWE-306

Missing Authentication for Critical Function

CWE-620

Unverified Password Change

{"id": "CVE-2026-104106", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-104106", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T13:52:03.051138Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "error311", "product": "FileRise", "versions": [{"status": "affected", "version": "< 3.23.0"}]}]}], "published": "2026-10-14T21:17:34.583", "references": [{"url": "https://github.com/error311/FileRise/commit/cc1118923b522baff28dca05bdd79c27f984c68a", "source": "security-advisories@github.com"}, {"url": "https://github.com/error311/FileRise/releases/tag/v3.23.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/error311/FileRise/security/advisories/GHSA-77m8-hm3q-mrr5", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-306"}, {"lang": "en", "value": "CWE-620"}]}], "descriptions": [{"lang": "en", "value": "FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise permits an authenticated session with a valid CSRF token to disable TOTP without recent full reauthentication or to begin enrollment when the account currently has no TOTP secret. The enrollment endpoint returns 409 rather than directly overwriting an already configured secret, but it persists and activates a newly generated secret before a TOTP code verifies possession. An attacker controlling an existing authenticated session can therefore disable an existing second factor or enroll one after the account has no configured secret; this is not a direct overwrite of an active authenticator. This issue is fixed in version 3.23.0."}], "lastModified": "2026-10-15T16:17:33.237", "sourceIdentifier": "security-advisories@github.com"}