FileRise EUVD-2026-101666

Exploitation requires the attacker to possess a remember-me token that was issued to their account while it held the administrator role (isAdmin=true) in users.txt, and for that account to subsequently be demoted rather than deleted, with the pre-demotion token still valid. The flaw is triggered only via the automatic (remember-me) login path, which reads the stored isAdmin flag instead of re-resolving the role. Limiting factors that reduce realistic risk: the attacker must be a former administrator (insider or compromised ex-admin account), must have retained a valid pre-demotion token, and the window closes once the token expires or the account is deleted; fresh users, never-demoted admins, and installs on 3.16.0+ are unaffected. This is not remote-unauthenticated - it depends on prior admin status and token possession.

This is a genuine but bounded privilege-retention flaw (CWE-613, insufficient session/token expiration), not a mass-exploitable critical. The vendor CVSS of 6.8 with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N is internally consistent with the description: AC:H and PR:L reflect that the attacker must already be a (now-demoted) low-privilege user who still holds a remember-me token minted while they were an administrator. There is no EPSS score, no CISA KEV listing, and no public POC in the provided intelligence, so exploitation status is 'no public exploit identified at time of analysis.' The real-world risk is therefore insider/post-demotion rather than opportunistic external attack - it requires a specific lifecycle (admin → token issued → demotion → stale token reused) that an outside attacker cannot normally engineer. Signals are not conflicting, but they are thin: there is no independent severity data (EPSS/KEV absent, which for a niche self-hosted project is expected and is NOT evidence of low risk by itself). The patch (f7114ca, v3.16.0) directly corrects the root cause by resolving admin status from the live user record. Net: medium priority - treat as important for any FileRise deployment that performs role demotions, low urgency for deployments that never demote admins.

An administrator of a FileRise instance checks 'remember me,' receiving a persistent token that embeds isAdmin=true. The organization later demotes that person to a standard user, but their account is kept active. On their next automatic login the stale token restores administrator privileges, letting them read, modify, and manage all files despite the demotion; token rotation then propagates the admin flag into every replacement token. No public exploit code is required or known.