FileRise CVE-2026-57489

Exploitable ONLY when all of the following hold: (1) the deployment has proxy-header authentication / AUTH_BYPASS enabled; (2) the configured reverse-proxy identity header (X-Remote-User) is accepted without validating the request source against FR_TRUSTED_PROXIES - the exact flaw fixed in 3.16.0; and (3) the backend application port is directly reachable by the attacker, bypassing the proxy. Given those, an unauthenticated attacker simply supplies the X-Remote-User header naming any account (including admin) to get a session. LIMITING FACTORS: default deployments without proxy-header auth are NOT affected; deployments that correctly set FR_TRUSTED_PROXIES to the proxy IP/CIDR are NOT affected; and the backend must be exposed on an untrusted path rather than being accessible only through the proxy. These conditions (reflected as AC:H) substantially narrow the real-world exposed population.

CVSS 3.1 scores this 8.1 (High) with AV:N/AC:H/PR:N/UI:N and full C/I/A impact, correctly reflecting an unauthenticated network authentication-bypass (CWE-290) that yields administrator access. The AC:H is the critical modifier and is well-justified: exploitation is gated on a specific, non-default deployment posture rather than being universally reachable. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence set - so exploitation status is 'no public exploit identified at time of analysis,' and there is no evidence of active or widespread exploitation. The realistic risk is therefore conditional: for the subset of FileRise operators who enabled proxy-header authentication (AUTH_BYPASS) AND left the backend application port directly reachable without FR_TRUSTED_PROXIES validation, impact is severe (trivial admin takeover via a single header). For everyone else it is not exploitable. The source commit (f7114ca) independently confirms the root cause and the 3.16.0 fix, so the technical claim is high-confidence even though no exploitation telemetry exists. Net: a genuinely serious bug for affected configurations, but the absence of KEV/EPSS/POC plus the AC:H conditions make this a configuration-dependent priority rather than a mass-exploitation emergency.

A FileRise instance runs behind a reverse proxy with proxy-header login (AUTH_BYPASS) enabled, but its backend application port is also reachable directly on the network and FR_TRUSTED_PROXIES is unset or ineffective. An unauthenticated attacker connects straight to the backend and sends an HTTP request containing 'X-Remote-User: admin', and FileRise trusts the header without verifying the source, granting a full administrator session with no password or MFA. No public exploit code is identified, but the technique is a single crafted header and is confirmed by the fix commit.