CVE-2026-57493: FileRise: Remember-me auto-login uses stale admin role from token instead of current role
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise stores the isAdmin flag in remember-me tokens and restores that stale value during automatic login instead of resolving the account's current role from users.txt. A user who was issued a token while an administrator can retain administrator access after demotion, and token rotation copies the stale privilege into each replacement token. Exploitation requires possession of the pre-demotion remember-me token. This issue is fixed in version 3.16.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FileRiseto a version that resolves this vulnerability.Fixed in 3.16.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
FileRise deployments running versions before 3.16.0 are affected when a user was previously an administrator, was later demoted, and still has a remember-me token issued while they held administrator privileges.
What does an attacker need to exploit it?
The attacker must possess a pre-demotion remember-me token that was issued to the account while it had administrator privileges. Exploitation does not require user interaction, but the attack complexity is rated high.
Are replacement remember-me tokens safe after the user is demoted?
No. Token rotation copies the stale administrator privilege into replacement tokens, so rotating an affected token does not remove the retained administrator access.
What should be done if immediate patching is not possible?
The provided data does not describe a workaround. Because token rotation preserves the stale privilege, remediation should not rely on rotation alone; upgrade to FileRise 3.16.0 when possible.