CVE-2026-104106: FileRise: 2FA disable and TOTP enrollment lack step-up re-authentication; enrollment activates before verification
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise permits an authenticated session with a valid CSRF token to disable TOTP without recent full reauthentication or to begin enrollment when the account currently has no TOTP secret. The enrollment endpoint returns 409 rather than directly overwriting an already configured secret, but it persists and activates a newly generated secret before a TOTP code verifies possession. An attacker controlling an existing authenticated session can therefore disable an existing second factor or enroll one after the account has no configured secret; this is not a direct overwrite of an active authenticator. This issue is fixed in version 3.23.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FileRiseto a version that resolves this vulnerability.Fixed in 3.23.0
Event History
Frequently Asked Questions
Which deployments are affected?
FileRise versions before 3.23.0 are affected. The issue applies to accounts with an authenticated session and a valid CSRF token, particularly where an attacker can control or hijack such a session.
What does an attacker need to exploit this issue?
The attacker needs control of an existing authenticated session and a valid CSRF token. No user interaction is required, but the attacker cannot directly replace a TOTP secret that is already configured because that enrollment path returns HTTP 409.
What account changes can an attacker make?
An attacker controlling a qualifying session can disable an existing TOTP factor without recent full reauthentication. If the account has no configured TOTP secret, the attacker can start enrollment and cause a newly generated secret to be persisted and activated before TOTP possession is verified.
How can I determine whether an account may have been affected?
Review whether the affected FileRise instance was running a version earlier than 3.23.0 and investigate unexpected TOTP disablement or new TOTP enrollment on accounts that previously had no configured secret. The provided information does not identify specific audit-log events or indicators.
What is the remediation?
Upgrade FileRise to version 3.23.0, which fixes the issue. For potentially affected accounts, verify the current TOTP configuration and require users to re-establish their intended authenticator where unauthorized changes are suspected.