CVE-2026-44460

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.12.0, /api/totp_setup.php is callable from a session that has only passed the password check (state pending_login_user). When the target account already has TOTP configured, the endpoint decrypts and returns the user's existing TOTP secret inside the QR PNG instead of refusing or generating a new secret. An attacker who already possesses the victim's password can therefore retrieve the live TOTP secret, derive a valid one-time code, submit it to /api/totp_verify.php, and obtain a fully authenticated session without ever possessing the victim's authenticator device. This vulnerability is fixed in 3.12.0.

• CWE-200
• CWE-287
• CWE-306

• https://github.com/error311/FileRise/security/advisories/GHSA-84hw-8g73-v3f8
• https://github.com/error311/FileRise/security/advisories/GHSA-84hw-8g73-v3f8

Published

May 27, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44455Hono is a Web application framework that provides support fo…6.1
• CVE-2026-44456Hono is a Web application framework that provides support fo…6.5
• CVE-2026-44457Hono is a Web application framework that provides support fo…5.3
• CVE-2026-44458Hono is a Web application framework that provides support fo…4.3
• CVE-2026-44459Hono is a Web application framework that provides support fo…3.8
• CVE-2026-4446Use after free in WebRTC in Google Chrome prior to 146.0.768…8.8
• CVE-2026-44461Zed is a code editor. Prior to 0.227.1, Zed builds SSH/WSL r…8.6
• CVE-2026-44462Zed is a code editor. Prior to 0.229.0, Zed's terminal tool …8.8
• CVE-2026-44463Zed is a code editor. Prior to 0.229.0, Zed's terminal tool …7.8
• CVE-2026-44465Zed is a code editor. Prior to 0.227.1, Zed IDE executes arb…8.6
• CVE-2026-44466Zed is a code editor. Prior to 0.229.0, Zed's terminal tool …8.6
• CVE-2026-44467The Claude Desktop app gives you Claude Code with a graphica…6.8