Key points
- FileRise versions before 3.23.0 contain a high-severity authentication bypass.
- Attackers can impersonate existing users, including administrators, using OIDC claims.
- The vendor has released version 3.23.0 which fixes this security issue.
FileRise versions prior to 3.23.0 are affected by a high-severity vulnerability that allows attackers to bypass authentication controls. The flaw enables malicious actors to log in as existing local accounts, including the built-in administrator, by exploiting how the application maps external identity provider claims to local users.
In plain English
FileRise is a self-hosted web-based file manager that supports multi-file upload, editing, and batch operations. The security issue arises because the software maps an authenticated OpenID Connect (OIDC) identity to a local account using mutable claims such as preferred_username or email. The application does not require the email_verified flag for email-based naming, creating a potential collision vector.
The background
According to the NVD record for CVE-2026-104108, the weakness is rated 8.1 on the CVSS scale. An attacker who can obtain provider-issued claims that collide with an existing local username can be logged in as that account. This exploitation is possible even when automatic provisioning is disabled within the FileRise settings.
What changes now
The vendor has addressed this issue in version 3.23.0. This update fixes the mapping logic to prevent unauthorized account takeover via OIDC claim collisions. Users running any version of FileRise older than 3.23.0 are exposed to this risk and should apply the patch immediately to secure their file management infrastructure.
Who needs to act first
Teams should prioritize updating systems that expose FileRise to external networks or untrusted identity providers. Check whether your instance allows login via third-party OIDC services before applying the patch. Back up your configuration and database before rolling out the update to ensure a safe rollback path. Verify that the new version enforces stricter claim validation. Monitor logs for any unusual login attempts during the transition period to detect potential exploitation attempts.
What to do and how to stay safe: FileRise
- Identify all FileRise instances currently running versions older than 3.23.0.
- Download and install the 3.23.0 update to patch the authentication bypass.
- Review your identity provider settings to ensure email_verified claims are enforced.
- Monitor access logs for unexpected administrative logins following the update.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-104108?
The vulnerability has a CVSS score of 8.1, which is rated as high severity.
Does this vulnerability require automatic provisioning to be enabled?
No, an attacker can log in as an existing account even when automatic provisioning is disabled.
Which versions of FileRise are affected by this flaw?
All versions of FileRise prior to 3.23.0 are affected by this identity mapping issue.
