Skip to main content

File Browser CVE-2026-72839

| EUVDEUVD-2026-58547 CRITICAL
Incorrect Privilege Assignment (CWE-266)
2026-08-13 disclosure@vulncheck.com GHSA-6g9f-8x2v-mq2c
Information Disclosure
9.3
CVSS 4.0 · Vendor: vulncheck
Share

Severity by source

Vendor (vulncheck) PRIMARY
9.3 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.8 CRITICAL

Unauthenticated remote registration grants root-scope file read/write/delete, so PR:N and C:H/I:H/A:H; the non-default self-signup precondition has no 3.1 equivalent so AC stays L.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Aug 13, 2026 - 22:31 vuln.today
CVE Published
Aug 13, 2026 - 22:17 cve.org
CRITICAL 9.3

DescriptionCVE.org

filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is enabled with default CreateUserDir setting. Unauthenticated attackers can register accounts that inherit the server root scope with full create, modify, delete, rename, share, and download permissions, allowing unrestricted access to all files.

AnalysisAI

Privilege escalation in File Browser (filebrowser) through version 2.63.16 lets unauthenticated attackers self-register accounts that inherit the server's root scope with full create, modify, delete, rename, share, and download permissions, granting complete access to every file the server can reach. The flaw only manifests when the optional self-signup feature is enabled together with the default CreateUserDir behavior. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Locate exposed File Browser with signup enabled
Exploit
Register account via public signup
Execution
Account inherits root scope and full permissions
Impact
Read, modify, and delete all server files
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the File Browser instance has self-signup (public user registration) enabled AND the CreateUserDir setting left at its default - this specific combination is the named prerequisite from the advisory, and self-signup is not enabled by default, which is the primary factor limiting real-world exposure. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) scores 9.3 and describes fully remote, unauthenticated, low-complexity exploitation with high confidentiality, integrity, and availability impact - consistent with the description of anonymous accounts gaining root-scope read/write/delete. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker discovers an internet-exposed File Browser instance with public registration enabled, visits the signup page, and creates an account with no prior credentials. The new account is automatically granted the server root scope with full permissions, so the attacker immediately browses, downloads, modifies, and deletes any file the server process can access. …
Remediation Consult the vendor GitHub Security Advisory GHSA-6759-996p-gpj6 (https://github.com/filebrowser/filebrowser/security/advisories/GHSA-6759-996p-gpj6) and upgrade to the fixed release it designates; no exact patched version number is provided in the available data, so the patch is available per vendor advisory but the released patched version is not independently confirmed here - verify the target version against the advisory before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, immediately disable the self-registration feature in File Browser settings to prevent unauthorized account creation. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-266 – Incorrect Privilege Assignment

View all
CVE-2025-27007 CRITICAL POC
9.8
CVE-2024-28000 CRITICAL POC
9.8
CVE-2026-48172 CRITICAL POC
10.0
CVE-2024-24882 CRITICAL POC
9.8
CVE-2025-47539 CRITICAL POC
9.8
CVE-2022-20759 HIGH POC
8.8
CVE-2024-54363 CRITICAL
9.8
CVE-2026-23550 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-72839 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy