CVE-2026-104108: FileRise OIDC login can bind an attacker identity to an existing local account
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise maps an authenticated OIDC identity to a local account using mutable preferredusername or email claims and does not require emailverified for email-based naming. An attacker who can obtain provider-issued claims colliding with an existing local username can be logged in as that account, including the built-in administrator, even when automatic provisioning is disabled. Exploitability depends on the configured identity provider allowing the colliding claim. This issue is fixed in version 3.23.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FileRiseto a version that resolves this vulnerability.Fixed in 3.23.0
Event History
Frequently Asked Questions
Which deployments are exposed to account takeover?
FileRise deployments prior to 3.23.0 that use OIDC are exposed if their identity provider can issue a preferred_username or email claim that collides with an existing FileRise local username. Automatic provisioning does not need to be enabled for exploitation.
What does an attacker need to exploit this issue?
The attacker needs to authenticate through the configured OIDC provider and obtain provider-issued claims that match an existing local username. Exploitation depends on the provider allowing the attacker to receive the colliding preferred_username or email claim.
Can the built-in administrator account be affected?
Yes. A collision with the built-in administrator's local username can allow the attacker to be logged in as that administrator account.
What is the remediation?
Upgrade FileRise to version 3.23.0, which fixes the identity-to-local-account mapping issue.