CVE-2026-69191: FileRise: Login Method Restriction Bypass via Direct API Access
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.21.0, FileRise enforces disableFormLogin, disableBasicAuth, and disableOIDCLogin in the client interface but not consistently in the corresponding server-side authentication flows. A user with otherwise valid credentials for a disabled method can call its backend endpoint directly and authenticate despite the administrator's login-method policy. The flaw does not permit credential-free authentication. This issue is fixed in version 3.21.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FileRiseto a version that resolves this vulnerability.Fixed in 3.21.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs valid credentials for a FileRise account and network access to the affected instance. The issue does not allow credential-free authentication.
Are default deployments affected?
The issue is relevant when an administrator has disabled form login, Basic authentication, or OIDC login through the specified login-method settings. Those restrictions can be bypassed by sending requests directly to the corresponding backend authentication endpoint.
What should be done if an immediate upgrade is not possible?
Treat credentials for login methods that were intended to be disabled as still usable, because the client-side restriction is not reliably enforced by the server. Restrict access to the FileRise instance and review which accounts have valid credentials for those methods until version 3.21.0 can be deployed.
How can administrators determine whether they are affected?
Instances running a FileRise version before 3.21.0 are affected if they rely on disableFormLogin, disableBasicAuth, or disableOIDCLogin to prevent use of those authentication methods. Test or review whether a valid account can authenticate through the relevant backend endpoint even though that method is disabled in the client interface.