CVE-2026-69193: FileRise: Rate Limiting Bypass via Username Rotation Enables Unlimited Password Spraying
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.21.0, FileRise tracks failed logins only by the combination of source IP address and username. A remote unauthenticated attacker can rotate usernames to obtain a fresh per-account attempt budget for each name, enabling password spraying from one source beyond the intended limit. Per-user limits still apply and can also produce distinguishable throttling behavior for targeted accounts. The affected surface is AuthModel::getFailedLoginKey(). This issue is fixed in version 3.21.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FileRiseto a version that resolves this vulnerability.Fixed in 3.21.0
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
FileRise versions prior to 3.21.0 are affected where login authentication is reachable by a remote attacker. The attacker does not need an account or user interaction.
What does an attacker need to do to evade the intended rate limit?
The attacker can submit login attempts from a single source IP while rotating usernames. Because failed-login tracking uses the source-IP and username combination, each different username receives a separate attempt budget.
Does this remove all login throttling?
No. Per-user limits still apply, but the username-rotation behavior allows password spraying beyond the intended limit from one source. Targeted accounts may also show distinguishable throttling behavior.
What version fixes the issue?
Upgrade FileRise to version 3.21.0, which fixes the affected AuthModel::getFailedLoginKey() logic.