FileRise CVE-2026-92616

Exploitation requires (1) valid low-privilege Basic-Auth credentials to the FileRise WebDAV interface, and (2) an active administrator web-application session whose PHPSESSID cookie the attacker can supply alongside those credentials. The flaw is that the WebDAV layer inherits elevated privileges from this ambient web session rather than performing independent stateless per-request authentication as required by RFC 4918. Limiting factors: the attacker must already be authenticated (PR:L), a concurrent live admin session must exist and its PHPSESSID be obtainable (the basis for the AC:H rating), and only versions before 3.28.0 are affected. These conditions make exploitation dependent on a co-occurring privileged session rather than achievable by a lone attacker at will.

The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N, base 7.6) describes a network-reachable privilege escalation requiring low-privilege authentication (PR:L) and carrying elevated attack complexity (AC:H). The AC:H rating is well-justified: the description makes clear the attacker must combine valid Basic-Auth credentials with an *active admin PHPSESSID cookie* - meaning an administrator must have a live web session whose ambient context the WebDAV layer erroneously inherits. This is not a self-contained flaw an attacker can trigger unilaterally; it depends on a concurrent privileged session existing, which materially limits opportunistic exploitation. No EPSS score, no CISA KEV listing, and no public POC are present in the provided intelligence, so this is 'no public exploit identified at time of analysis' - a real but not urgent priority. The patch is confirmed available (v3.28.0). Net: a genuine authorization-boundary bug reported by a credible source (VulnCheck), but the AC:H prerequisite of a co-occurring admin session plus already-held low-priv credentials keeps real-world exploitability targeted rather than mass-exploitable. Note a signal tension worth verifying: the release notes only vaguely say 'Improved consistency of WebDAV request handling,' which does not explicitly confirm the session-isolation fix described in the advisory - the security fix is inferred from the VulnCheck advisory, not the changelog text.

A low-privilege FileRise user who already holds valid Basic-Auth credentials waits for or coincides with an active administrator web session, then issues WebDAV requests carrying the admin's PHPSESSID cookie. Because the WebDAV layer inherits privileges from the ambient web session instead of enforcing independent stateless RFC 4918 authentication, the attacker gains admin-level read/write access to files. No public exploit code is identified at time of analysis, and the AC:H rating reflects the need for a concurrent privileged session.