CVE-2026-50891: Filestash Privilege Escalation Vulnerability

CVE-2026-50891 Overview

CVE-2026-50891 is a broken access control vulnerability affecting Filestash v0.4.0, an open-source web file manager. The flaw resides in the /admin/api/config component, which fails to properly enforce authorization checks. An authenticated attacker with low privileges can escalate to administrative access by sending a crafted HTTP request to the affected endpoint. The vulnerability is classified under [CWE-284] (Improper Access Control) and carries a CVSS v3.1 base score of 8.1. Successful exploitation grants attackers the ability to modify application configuration, exposing connected storage backends and stored credentials.

Critical Impact
Authenticated attackers can escalate privileges to administrator and modify Filestash configuration, compromising connected storage backends and the confidentiality and integrity of managed file shares.

Affected Products

Filestash v0.4.0
Filestash deployments exposing the /admin/api/config endpoint
Self-hosted Filestash instances accessible to authenticated users

Discovery Timeline

2026-06-15 - CVE-2026-50891 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-50891

Vulnerability Analysis

Filestash exposes administrative functionality through the /admin/api/config endpoint. This endpoint manages application-wide configuration, including storage backend definitions, authentication providers, and secret values. The endpoint does not adequately validate the requester's privilege level before processing configuration changes. As a result, a user holding only a low-privilege session token can issue requests that should be restricted to administrators.

The issue is a server-side authorization failure rather than a client-side control bypass. Once configuration is modified, the attacker can pivot to read or alter files managed through Filestash and harvest stored backend credentials.

Root Cause

The root cause is missing or insufficient role enforcement on the administrative API handler. The component checks that a request is authenticated but does not verify that the caller holds an administrator role before applying configuration changes. This maps directly to [CWE-284] Improper Access Control, where the security model assumes elevated privileges that the runtime never enforces.

Attack Vector

The attack vector is network-based and requires low-level authentication. An attacker first establishes any authenticated session against the Filestash instance. The attacker then issues a crafted HTTP request to /admin/api/config containing a modified configuration payload. The server processes the request without rejecting it on authorization grounds. No user interaction is required, and the exploitation chain produces persistent changes to Filestash's running configuration. Public proof-of-concept material is referenced from a third-party gist, increasing the likelihood of opportunistic exploitation against exposed instances.

No verified code examples are available. See the GitHub Gist PoC Collection for technical details on the request structure.

Detection Methods for CVE-2026-50891

Indicators of Compromise

HTTP requests to /admin/api/config originating from non-administrator user sessions or unexpected source IPs.
Unexplained changes to Filestash backend configuration, including new storage providers, modified credentials, or altered authentication middleware.
Creation of new administrative accounts or session tokens shortly after low-privilege authentication events.

Detection Strategies

Inspect Filestash and reverse proxy access logs for POST or PUT requests against /admin/api/config and correlate with the authenticated user's role.
Establish a baseline of legitimate administrative activity and alert on configuration API calls outside of approved maintenance windows.
Hash the Filestash configuration file and monitor for unexpected modifications at the file-system layer.

Monitoring Recommendations

Forward Filestash application logs and the fronting web server's access logs to a centralized log platform for retention and correlation.
Alert on sequences where a low-privilege login is immediately followed by requests to administrative API paths.
Monitor outbound connections from the Filestash host for new destinations that could indicate attacker-supplied storage backends.

How to Mitigate CVE-2026-50891

Immediate Actions Required

Restrict network access to Filestash instances using firewall rules, VPN gating, or an authenticating reverse proxy until a patched release is deployed.
Audit existing Filestash configuration for unauthorized changes, unknown storage backends, or unexpected administrator accounts.
Rotate all credentials, API keys, and tokens stored within Filestash configuration, assuming exposure on internet-facing instances.

Patch Information

No vendor advisory or fixed version is referenced in the NVD record at the time of publication. Operators of Filestash v0.4.0 should track the upstream project for a release addressing [CWE-284] in the /admin/api/config handler and apply it as soon as it is available. Until then, treat all v0.4.0 deployments as exploitable by any authenticated user.

Workarounds

Place Filestash behind a reverse proxy that enforces an allowlist on the /admin/* path, limiting it to administrator source IPs.
Disable or remove non-administrative accounts on affected instances to reduce the pool of users that can reach the vulnerable endpoint.
Run Filestash on an isolated network segment with no direct internet exposure, requiring authenticated VPN access for any user interaction.

bash

# Example nginx restriction for the admin API path
location /admin/api/config {
    allow 10.0.0.0/24;   # administrator subnet
    deny all;
    proxy_pass http://filestash_backend;
}