CVE-2026-27611: FileBrowser Quantum Auth Bypass Flaw

CVE-2026-27611 Overview

CVE-2026-27611 is an Authentication Bypass vulnerability affecting FileBrowser Quantum, a free, self-hosted, web-based file manager. Prior to versions 1.1.3-stable and 1.2.6-beta, when users share password-protected files, the recipient can completely bypass the password and still download the file. This occurs because the API returns a direct download link in the details of the share, which is accessible to anyone with just the share link, even without providing the password.

Critical Impact

Attackers can bypass password protection on shared files by directly accessing the download link returned by the API, leading to unauthorized access to sensitive data without any authentication.

Affected Products

• FileBrowser Quantum versions prior to 1.1.3-stable
• FileBrowser Quantum versions prior to 1.2.6-beta

Discovery Timeline

• 2026-02-25 - CVE-2026-27611 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2026-27611

Vulnerability Analysis

This vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The flaw exists in the public share handler implementation within the FileBrowser Quantum application. When a user creates a password-protected file share, the application's API endpoint returns metadata about the share that includes a direct download URL. This direct download URL is accessible without requiring password authentication, effectively rendering the password protection mechanism useless.

The vulnerability is network-exploitable and requires no special privileges to exploit. An attacker only needs access to the share link itself—they do not need to know or provide the password that was supposed to protect the shared content. This represents a fundamental flaw in the access control logic where the API response reveals protected resources before authentication is verified.

Root Cause

The root cause of this vulnerability lies in the improper handling of share details in the backend/http/public.go file. The public share handler was exposing the direct download link in the API response before validating whether the requesting user had provided the correct password. The authentication check for password-protected shares was occurring at the wrong point in the request flow, allowing unauthenticated access to the download URL metadata.

Attack Vector

The attack vector for CVE-2026-27611 is network-based and requires user interaction in the form of accessing a share link. An attacker who obtains a FileBrowser Quantum share link (through phishing, social engineering, or by simply being the intended recipient) can:

1. Access the share link endpoint without providing the password
2. Examine the API response which contains the direct download URL
3. Use the direct download URL to retrieve the file contents
4. Bypass the password protection entirely

The security patch introduced proper user validation by importing the users database module and ensuring that authentication checks occur before exposing any download links:

 	"github.com/gtsteffaniak/filebrowser/backend/common/settings"
 	"github.com/gtsteffaniak/filebrowser/backend/common/utils"
 	"github.com/gtsteffaniak/filebrowser/backend/database/share"
+	"github.com/gtsteffaniak/filebrowser/backend/database/users"
 	"github.com/gtsteffaniak/filebrowser/backend/preview"
 	"github.com/gtsteffaniak/go-logger/logger"

Source: GitHub Commit Update

Detection Methods for CVE-2026-27611

Indicators of Compromise

• Unusual access patterns to share endpoints without corresponding password authentication events
• API responses containing direct download URLs being accessed multiple times without valid authentication
• Log entries showing file downloads from share links where password verification was never completed
• Anomalous download activity for files that should be password-protected

Detection Strategies

• Monitor FileBrowser Quantum access logs for requests to share detail endpoints followed immediately by direct download requests without password submission
• Implement alerting for any successful file downloads from password-protected shares where authentication events are missing
• Review API response logs for exposure of download URLs in unauthenticated contexts
• Deploy web application firewall rules to detect sequential access patterns indicative of this bypass technique

Monitoring Recommendations

• Enable verbose logging on the FileBrowser Quantum application to capture all share access attempts
• Implement network monitoring to track data exfiltration from the file manager service
• Set up alerts for downloads of sensitive files that bypass expected authentication workflows
• Regularly audit share configurations and access logs to identify potential exploitation

How to Mitigate CVE-2026-27611

Immediate Actions Required

• Upgrade FileBrowser Quantum to version 1.1.3-stable or later (for stable branch users)
• Upgrade FileBrowser Quantum to version 1.2.6-beta or later (for beta branch users)
• Audit existing password-protected shares to determine if unauthorized access may have occurred
• Consider regenerating share links for sensitive files after patching

Patch Information

The vulnerability has been fixed in FileBrowser Quantum versions 1.1.3-stable and 1.2.6-beta. The patch modifies the public share handler to properly validate user authentication before exposing download links. The fix is documented in the GitHub Security Advisory GHSA-8vrh-3pm2-v4v6 and the corresponding commit c51b0ee9738fa4599b409f47c5bf820ef31b4fe1.

Workarounds

• Disable password-protected file sharing functionality until the patch can be applied
• Use alternative secure file transfer methods for sensitive data until FileBrowser Quantum is updated
• Implement network-level access controls to restrict who can access FileBrowser Quantum share endpoints
• Consider placing FileBrowser Quantum behind an additional authentication layer such as a reverse proxy with authentication

# Configuration example
# Temporarily disable public shares in FileBrowser Quantum
# Set the following in your configuration file or environment:
FB_DISABLE_PUBLIC_LINKS=true

# If using Docker, add to your docker-compose.yml:
# environment:
#   - FB_DISABLE_PUBLIC_LINKS=true