FileRise CVE-2026-104106

Requires the attacker to already control an existing authenticated FileRise session (PR:L) and possess that session's valid CSRF token; with those, the pre-3.23.0 TOTP management endpoints can be invoked without a recent full reauthentication. Two distinct outcomes are possible: (1) disabling an already-configured TOTP second factor, or (2) beginning and activating enrollment of a new TOTP secret only when the account currently has NO TOTP secret. A key LIMITING factor stated in the description: the enrollment endpoint returns HTTP 409 and will NOT directly overwrite an already-configured active authenticator, so an account with active TOTP can only have it disabled, not silently re-enrolled. The dominant precondition - prior control of a valid authenticated session plus CSRF token - substantially narrows real-world exploitability beyond the raw network vector.

All signals point to a moderate, authentication-dependent issue rather than a top-priority emergency. The provided CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 6.5) requires an already-authenticated session (PR:L), so this is not an unauthenticated internet-facing bug; the sole impact is integrity (I:H) with no confidentiality or availability loss, consistent with CWE-306 (Missing Authentication for a Critical Function). No EPSS score, no CISA KEV listing, and no public POC were provided - so there is no evidence of active exploitation and the status is 'no public exploit identified at time of analysis.' SSVC-style reasoning: exploitation is not automatable in a mass-scan sense because it presupposes the attacker already controls a valid authenticated session, and technical impact is partial (it weakens or resets a second factor but, per the description, cannot directly overwrite an active authenticator - the enrollment endpoint returns 409). The headline risk is a step-up primitive: an attacker who already holds a session can disable the victim's existing TOTP (or enroll their own factor if none is set), degrading MFA and account-recovery defenses. Treat as a defense-in-depth / MFA-integrity fix to schedule promptly rather than an exploit-under-fire crisis. One mild tension to verify: the vector is AV:N yet the real precondition is prior session control, so the 'network' metric reflects HTTP transport, not easy remote reach.

An attacker who has already hijacked or otherwise obtained a victim's authenticated FileRise session (e.g., via a stolen cookie, a shared/kiosk machine, or a separate session-fixation flaw) issues a request carrying the valid CSRF token to the TOTP management endpoint. Because recent full reauthentication is not enforced before v3.23.0, the attacker disables the victim's existing TOTP second factor, or - if the account has no TOTP configured - begins and activates enrollment of an attacker-controlled secret. No public exploit code is identified at time of analysis.