CVE-2026-32760: Filebrowser Auth Bypass Vulnerability

CVE-2026-32760 Overview

CVE-2026-32760 is a critical privilege escalation vulnerability in File Browser, a web-based file management interface used for uploading, deleting, previewing, renaming, and editing files within a specified directory. This vulnerability allows any unauthenticated visitor to register a full administrator account when self-registration (signup = true) is enabled and the default user permissions include perm.admin = true.

The vulnerability exists in versions 2.61.2 and below, where the signup handler blindly applies all default settings—including administrative permissions—to newly created user accounts without any server-side validation to strip admin privileges from self-registered accounts.

Critical Impact

Unauthenticated attackers can gain full administrative access to the File Browser instance, allowing complete control over all files, users, and server settings without any authentication.

Affected Products

• File Browser versions 2.61.2 and earlier
• File Browser instances with self-registration enabled (signup = true)
• Deployments where default permissions include perm.admin = true

Discovery Timeline

• 2026-03-20 - CVE CVE-2026-32760 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-32760

Vulnerability Analysis

This vulnerability is classified under CWE-269 (Improper Privilege Management). The core issue lies in the signupHandler function which is designed to create unprivileged accounts for new visitors but fails to implement proper privilege controls.

When an administrator configures File Browser with default admin permissions enabled (defaults.perm.admin = true) and also enables the public signup feature, the signup handler copies all default settings—including administrative privileges—to every newly registered account. The handler contains no explicit user.Perm.Admin = false reset after applying default configurations, creating a pathway for complete privilege escalation.

This configuration oversight transforms the public registration endpoint into an administrative account creation mechanism, granting any unauthenticated user immediate full control over the File Browser instance.

Root Cause

The root cause of CVE-2026-32760 is the absence of server-side privilege sanitization in the signupHandler function. The handler assumes that default settings are always safe for public users, but it fails to account for misconfigurations where administrative permissions are included in the defaults.

The vulnerable code path applies the complete default user configuration without filtering sensitive permissions. This design flaw violates the principle of least privilege—self-registered accounts should never inherit administrative capabilities regardless of default configuration values.

Attack Vector

The attack vector for this vulnerability is network-based and requires no authentication. An attacker can exploit this vulnerability through the following sequence:

1. The attacker identifies a File Browser instance with self-registration enabled
2. The attacker accesses the public registration endpoint
3. The attacker submits a registration request to create a new user account
4. The server's signupHandler processes the request and applies default settings including perm.admin = true
5. The newly created account inherits full administrative privileges
6. The attacker logs in with their newly registered administrative account
7. The attacker gains complete control over all files, users, and server settings

The attack requires no special tools or techniques—only access to the registration endpoint. The vulnerability is exploitable whenever both self-registration is enabled and default admin permissions are misconfigured.

Detection Methods for CVE-2026-32760

Indicators of Compromise

• Unexpected user accounts with administrative privileges appearing in the user database
• New user registrations immediately followed by administrative actions such as configuration changes or file access outside normal scope
• Multiple administrator accounts when only one should exist
• Access to administrative endpoints from newly registered accounts

Detection Strategies

• Monitor and audit the File Browser user database for accounts with administrative privileges
• Review access logs for registration requests followed by administrative API calls
• Implement alerting on new user account creation events
• Establish baseline of expected administrator accounts and alert on deviations

Monitoring Recommendations

• Enable verbose logging for the File Browser application and monitor authentication events
• Set up alerts for any new user accounts being granted administrative permissions
• Regularly audit the File Browser configuration to ensure defaults.perm.admin is set to false
• Monitor for bulk file operations or configuration changes from recently created accounts

How to Mitigate CVE-2026-32760

Immediate Actions Required

• Upgrade File Browser to version 2.62.0 or later immediately
• Audit existing user accounts and remove administrative privileges from any unauthorized accounts
• Set defaults.perm.admin = false in the configuration to prevent future exploitation
• Consider disabling self-registration (signup = false) until the patch is applied

Patch Information

The vulnerability has been resolved in File Browser version 2.62.0. The fix ensures that self-registered accounts cannot inherit administrative privileges regardless of default configuration settings. The patch is available through the GitHub Release v2.62.0.

Additional details about the fix can be found in the GitHub Security Advisory GHSA-5gg9-5g7w-hm73 and the commit changes.

Workarounds

• Disable self-registration by setting signup = false in the File Browser configuration
• Ensure defaults.perm.admin is explicitly set to false in all deployments
• Implement network-level access controls to restrict access to the registration endpoint
• Use a reverse proxy to block public access to the /api/signup endpoint if self-registration must remain enabled

# Configuration example - Disable admin permissions in defaults
# In your File Browser config file or startup command:
filebrowser -d /path/to/filebrowser.db config set --signup=false
filebrowser -d /path/to/filebrowser.db config set --perm.admin=false