FileRise CVE-2026-104108

Requires the FileRise deployment to be configured with OIDC SSO. The configured identity provider must allow an attacker-influenced mutable preferred_username claim, or an unverified email claim (FileRise did not require email_verified for email-based naming), that collides with an existing local username such as the built-in 'admin'. The attacker must be able to authenticate at that IdP to obtain the colliding provider-issued claim. The bypass works even when OIDC automatic provisioning is disabled. Limiting factors: deployments without OIDC are unaffected; IdPs that enforce immutable usernames, require verified email, or do not permit the colliding claim prevent exploitation - this precondition is what drives the AC:H rating and narrows realistic exposure below the raw CVSS score.

The assigned CVSS 3.1 score of 8.1 (High) reflects a network-reachable (AV:N), no-privilege (PR:N), no-interaction (UI:N) authentication bypass yielding full confidentiality, integrity, and availability impact (C:H/I:H/A:H) - consistent with full takeover of the built-in administrator account. The single factor holding this below Critical is AC:H (high attack complexity), which correctly captures that exploitation is not universal: per the description, 'exploitability depends on the configured identity provider allowing the colliding claim.' No EPSS score, no CISA KEV listing, and no SSVC decision data were provided in the input, and no public exploit was identified, so automated/widespread-exploitation signals are absent. Weighing these together, this is a genuine, high-impact auth bypass (admin account takeover with auto-provisioning disabled) but its real-world reach is gated by a precondition the attacker does not fully control - whether the federated IdP permits a colliding mutable preferred_username or unverified email claim. This points to opportunistic/targeted exploitation against specific misconfigured OIDC deployments rather than broad, scriptable mass exploitation. Note the PR:N/network framing deserves nuance: the attacker needs no FileRise privilege, but does need the ability to authenticate at the configured IdP and influence its claims - verify against your specific IdP configuration.

An organization runs FileRise behind OIDC SSO with an identity provider that lets users choose or change their preferred_username (or accepts unverified email). An attacker who can authenticate at that IdP sets their preferred_username - or an unverified email - to collide with an existing local FileRise username such as the built-in 'admin', then completes an OIDC login and is mapped onto that administrator account, even with automatic provisioning disabled. No public exploit was identified at time of analysis, and success depends on the IdP permitting the colliding claim (reflected by AC:H).