CVE-2026-104108

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise maps an authenticated OIDC identity to a local account using mutable preferred_username or email claims and does not require email_verified for email-based naming. An attacker who can obtain provider-issued claims colliding with an existing local username can be logged in as that account, including the built-in administrator, even when automatic provisioning is disabled. Exploitability depends on the configured identity provider allowing the colliding claim. This issue is fixed in version 3.23.0.

• CWE-287
• CWE-290
• CWE-345

• https://github.com/error311/FileRise/commit/cc1118923b522baff28dca05bdd79c27f984c68a
• https://github.com/error311/FileRise/releases/tag/v3.23.0
• https://github.com/error311/FileRise/security/advisories/GHSA-c5c5-mv9m-j367
• https://github.com/error311/FileRise/security/advisories/GHSA-c5c5-mv9m-j367

Published

Oct 14, 2026

Last Modified

Oct 20, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1040867-Zip before 26.03 contains an uninitialized memory disclosu…5.5
• CVE-2026-104102copyparty is a portable file server. Prior to 1.20.19, FTP u…5.3
• CVE-2026-104103Ludwig is a low-code framework for building custom LLMs, neu…8.1
• CVE-2026-104105FileRise is a self-hosted web-based file manager with multi-…6.4
• CVE-2026-104106FileRise is a self-hosted web-based file manager with multi-…6.5
• CVE-2026-104107FileRise is a self-hosted web-based file manager with multi-…6.5
• CVE-2026-104109FileRise is a self-hosted web-based file manager with multi-…6.8
• CVE-2026-104110FileRise is a self-hosted web-based file manager with multi-…5.3
• CVE-2026-104112A missing release of resources in the illumos name service c…6.8
• CVE-2026-104113A double free in the IP management daemon (ipmgmtd) of OmniO…5.4
• CVE-2026-104114A NULL pointer dereference in the illumos Network Auto-Magic…5.4
• CVE-2026-104115A stack-based buffer overflow in the illumos reparse point d…5.4