PT-2026-25858 · Unknown · Filebrowser

Fg0X0 · Published 2026-03-16 · Updated 2026-03-27 · CVE-2026-32760

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions File Browser versions 2.61.2 and below

Description File Browser, a file managing interface, has an issue where unauthenticated users can register as full administrators if self-registration is enabled (signup = true) and the default user permissions have perm.admin = true. The signup handler applies all default settings, including Perm.Admin, to new users without server-side protection to prevent administrative privileges for self-registered accounts. Specifically, the settings.UserDefaults.Apply function in settings/defaults.go and the settings API in http/settings.go allow an administrator to configure defaults.perm.admin to true, and enabling signup allows any account created via the public registration endpoint to become an administrator with full control over files, users, and server settings. The vulnerable code is located in http/auth.go. The issue is resolved in version 2.62.0.

Recommendations Versions prior to 2.62.0 are affected. Update to version 2.62.0 or later.

Exploit

Fix

LPE

Improper Access Control

Improper Privilege Management

Weakness Enumeration

CWE-284

CWE-269

Related Identifiers

CVE-2026-32760

GHSA-5GG9-5G7W-HM73

GO-2026-4710

SUSE-SU-2026:1135-1

Affected Products

Filebrowser

References · 156

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32760.json · Exploit
• https://github.com/filebrowser/filebrowser/commit/a63573b67eb302167b4c4f218361a2d0c138deab · Patch
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-5gg9-5g7w-hm73 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32760 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:1135-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4710 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32760 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5gg9-5g7w-hm73 · Vendor Advisory
• https://github.com/filebrowser/filebrowser · Note
• https://github.com/filebrowser/filebrowser/releases/tag/v2.62.0 · Note
• https://suse.com/security/cve/CVE-2026-29785 · Note
• https://suse.com/security/cve/CVE-2026-33217 · Note
• https://suse.com/security/cve/CVE-2026-33676 · Note
• https://suse.com/security/cve/CVE-2026-4404 · Note
• https://suse.com/security/cve/CVE-2026-33322 · Note