CVE-2026-32761: File Browser has an Authorization Policy Bypass in its Public Share Download Flow
Summary A permission enforcement flaw allows users without download privileges (download=false) to still expose and retrieve file content via public share links when they retain share privileges (share=true). This bypasses intended access control policy and enables unauthorized data exfiltration to unauthenticated users. Where download restrictions are used for data-loss prevention or role separation.
Details The backend applies inconsistent authorization checks across download paths:
- Direct raw download correctly enforces Perm.Download: - [raw.go](filebrowser/http/raw.go:82) - Share creation only enforces Perm.Share: - [share.go](filebrowser/http/share.go:21) - Public share/download handlers serve shared content without verifying owner Perm.Download: - public.go(filebrowser/http/public.go:18) - public.go(filebrowser/http/public.go:116)
As a result, a user who is blocked from direct downloads can create a share and obtain the same file via /api/public/dl/<hash>.
PoC
1. Create a non-admin user with: - perm.share = true - perm.download = false
2. Login as that user and upload a PDF file: - POST /api/resources/nodlsecret<rand>.pdf with Content-Type: application/pdf
3. Verify direct raw download is denied: - GET /api/raw/nodlsecret<rand>.pdf - Expected and observed: 202 Accepted (blocked)
4. Create share for same file: - POST /api/share/nodlsecret<rand>.pdf - Observed: 200, response includes hash (example: qxfK3JMG)
5. Download publicly without authentication: - GET /api/public/dl/<hash> - Observed (vulnerable): 200, Content-Type: application/pdf, and PDF bytes are returned
Live evidence captured (March 1, 2026): - create user: 201 - create file: 200 - direct /api/raw: 202 Accepted - create share: 200 - public download /api/public/dl/mxK-ppZb: 200 - public download content-type: application/pdf - public download body length: 327 bytes
Impact This is an access control / authorization policy bypass vulnerability.
- Who can exploit: Any authenticated user granted share=true but denied download. - Who is impacted: Operators and organizations relying on download restrictions to prevent data export. - What can happen: Restricted users can still distribute and retrieve files publicly, including unauthenticated access through share URLs.
Other sources
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Versions 2.61.0 and below contain a permission enforcement bypass which allows users who are denied download privileges (perm.download = false) but granted share privileges (perm.share = true) to exfiltrate file content by creating public share links. While the direct raw download endpoint (/api/raw/) correctly enforces the download permission, the share creation endpoint only checks Perm.Share, and the public download handler (/api/public/dl/<hash>) serves file content without verifying that the original file owner has download permission. This means any authenticated user with share access can circumvent download restrictions by sharing a file and then retrieving it via the unauthenticated public download URL. The vulnerability undermines data-loss prevention and role-separation policies, as restricted users can publicly distribute files they are explicitly blocked from downloading directly. This issue has been fixed in version 2.62.0.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32761?
The severity of CVE-2026-32761 is considered high due to the potential for unauthorized data exfiltration.
How does CVE-2026-32761 exploit the security model?
CVE-2026-32761 exploits the security model by allowing users with share privileges to access files without download permissions.
What software versions are affected by CVE-2026-32761?
CVE-2026-32761 affects versions of Filebrowser up to and including 2.61.0.
What can I do to mitigate the risk of CVE-2026-32761?
To mitigate the risk of CVE-2026-32761, ensure that proper access controls are configured and consider upgrading to a patched version of Filebrowser.
Are there any workarounds for CVE-2026-32761?
Currently, there are no official workarounds available for CVE-2026-32761, other than adjusting share and download permissions.