CVE-2025-46296: Claris FileMaker Server Auth Bypass Flaw

CVE-2025-46296 Overview

CVE-2025-46296 is an authorization bypass vulnerability in the Claris FileMaker Server Admin Console. Administrator accounts with minimal privileges can access administrative features that should be restricted to higher-privileged roles. Affected functionality includes viewing license details and downloading application logs. Claris has fully addressed the issue in FileMaker Server 22.0.4.

The flaw is tracked under CWE-285: Improper Authorization and is exploitable over the network by an authenticated user with low privileges. No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported.

Critical Impact

Low-privileged administrator accounts can retrieve licensing metadata and download application logs, exposing configuration and operational data that may contain sensitive information useful for further attacks.

Affected Products

• Claris FileMaker Server versions prior to 22.0.4
• Claris FileMaker Server Admin Console
• Deployments using tiered administrator role assignments

Discovery Timeline

• 2025-12-16 - CVE-2025-46296 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46296

Vulnerability Analysis

The FileMaker Server Admin Console enforces role-based access control across its administrative functions. The vulnerability stems from missing authorization checks on specific endpoints that expose license information and application log downloads. An administrator role provisioned with minimal privileges can invoke these functions directly.

The exposed data can aid reconnaissance against the server. License records reveal deployment metadata such as edition, seat counts, and organizational identifiers. Application logs may contain database names, user identifiers, IP addresses, query patterns, and error traces that assist further compromise of the FileMaker environment.

Exploitation requires an authenticated session with a valid low-privilege administrator credential. No user interaction is needed once the attacker holds the account. The confidentiality and integrity impact is limited, and there is no availability impact.

Root Cause

The underlying defect is improper authorization ([CWE-285]) in the Admin Console request handlers. The affected endpoints validate authentication but do not verify that the acting role possesses the specific privilege required to view license details or export logs. Authorization enforcement is inconsistent across administrative functions.

Attack Vector

An attacker with a low-privilege administrator account authenticates to the FileMaker Server Admin Console over the network. The attacker then issues requests to administrative endpoints that expose license information and log download functionality. Because the server does not check the caller's effective privilege level, the requests succeed and return data intended only for full administrators.

No exploitation code example is available. See the Claris security advisory for vendor-supplied technical detail.

Detection Methods for CVE-2025-46296

Indicators of Compromise

• Admin Console access log entries showing low-privileged administrator accounts requesting license information or log download endpoints
• Unexpected outbound transfers of FileMaker Server application logs to non-administrator workstations
• Repeated authenticated requests from a single low-privilege administrator to administrative URIs outside their normal usage pattern

Detection Strategies

• Enable verbose Admin Console access logging and forward events to a centralized log platform for correlation
• Baseline which administrator accounts legitimately access license and log-export functions, then alert on deviations
• Correlate Admin Console activity with role assignment changes in the FileMaker Server configuration store

Monitoring Recommendations

• Review Admin Console audit trails weekly for privilege-scoped anomalies until all servers are upgraded to 22.0.4
• Alert on any successful license or log-export API call originating from an account not designated as a full administrator
• Track authentication events for administrator accounts and flag sessions that access endpoints outside the account's documented role scope

How to Mitigate CVE-2025-46296

Immediate Actions Required

• Upgrade Claris FileMaker Server to version 22.0.4, which fully addresses the authorization bypass
• Audit all administrator role assignments and remove accounts that do not require Admin Console access
• Rotate credentials for any low-privileged administrator accounts that may have been misused prior to patching

Patch Information

Claris released the fix in FileMaker Server 22.0.4. Full remediation details are published in the Claris Support Answer View. Administrators should review release notes before upgrading production servers and verify that custom deployments and add-ons remain compatible with 22.0.4.

Workarounds

• Restrict Admin Console network exposure to a management VLAN or bastion host until the upgrade is complete
• Reduce the number of administrator accounts and enforce that only fully privileged administrators can authenticate to the Admin Console
• Enable multi-factor authentication and strong password policies for all FileMaker Server administrator accounts

# Configuration example
# Restrict Admin Console TCP/16000 to a management subnet on the FileMaker Server host
# Linux (firewalld) example:
sudo firewall-cmd --permanent --zone=drop --add-source=0.0.0.0/0
sudo firewall-cmd --permanent --zone=trusted --add-source=10.10.20.0/24
sudo firewall-cmd --permanent --zone=trusted --add-port=16000/tcp
sudo firewall-cmd --reload