CVE Intelligence
Analysis AI-assisted

CVE-2026-54089: File Browser: authentication bypass in proxy authentication mode

File Browser versions starting with 2.0.0-rc.1 that use proxy authentication (auth.method=proxy) can let an unauthenticated attacker with direct network access to the server impersonate any user, including administrators. The same condition can also let an attacker create user accounts by specifying a non-existent username. The record rates the issue critical with a CVSS 3.1 score of 9.1, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

File Browser is a web-based file manager. The record describes an authentication weakness in proxy authentication mode (auth.method=proxy), starting with version 2.0.0-rc.1, that can be abused without credentials when the server is reachable directly. The project's GitHub Security Advisory is the primary source, and the record also links to the proxy authentication source code.

Impact

  • An unauthenticated party with direct access to the server may act as any user, including administrators.
  • Supplying a non-existent username can cause an account to be created automatically, without authorization.
  • The advisory provider assigns a CVSS 3.1 base score of 9.1, reflecting network reachability, low complexity, no privileges and no user interaction, with high confidentiality and integrity impact.

Affected products and versions

  • Product: File Browser (filebrowser/filebrowser).
  • The record states the condition applies starting with version 2.0.0-rc.1 when proxy authentication is configured.
  • The record does not provide an upper bound for affected versions and does not list fixed versions.

Exploitation status

  • The record shows the CVE is not listed in the CISA KEV catalog. No confirmed exploitation in the wild appears in the sources consulted.
  • No EPSS score is available in the record.

Remediation and mitigation

  • Identify whether File Browser instances use proxy authentication and whether the server is reachable without passing through the trusted authentication gateway.
  • Restrict network access so that only the trusted gateway can reach the service.
  • Check the upstream advisory for patch or configuration guidance, since the record does not identify a fixed version.
  • Where proxy authentication is not required, consider switching to another authentication method supported by the project.

Detection guidance

  • Review user account lists for accounts that administrators did not create, especially recent ones.
  • Review web server and application logs for requests that reach the service without passing through the expected gateway.
  • Confirm that the trusted gateway removes or overwrites identity-related headers supplied by clients.

Limitations of the available information

  • The record does not specify the exact vulnerable upper bound or any fixed version.
  • Technical details beyond the summary in the record are not included here.
  • Exploitation beyond the KEV status and the absence of EPSS data is unknown.
  • The record's source status is Deferred, so the information may change.

Frequently asked questions

Which File Browser versions are affected?

The record states the issue starts with version 2.0.0-rc.1 when proxy authentication is configured. It does not give an upper bound, so later versions must be checked against the upstream advisory.

Does this issue require credentials to exploit?

According to the record, no credentials are required when the server is reachable directly by an attacker.

Is there a fixed version?

The record does not list any fixed version. The absence of fix data does not mean no fix exists, so the upstream advisory should be consulted.

Is this issue known to be exploited in the wild?

The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

What is the most important defensive step?

Limit network access so only a trusted authentication gateway can reach the service, and review user accounts for unexpected entries.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.