CVE-2026-54089

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Starting with 2.0.0-rc.1, when FileBrowser is configured with proxy authentication (auth.method=proxy), any unauthenticated attacker who can reach the server directly can impersonate any user - including admin - by sending a single forged HTTP header. No credentials are required. Additionally, specifying a non-existent username causes the server to automatically create a new user account, providing an account creation primitive with no authorization. This is an already known issue that has been documented in the documentation for several years, but has not been documented as a vulnerability before.

• CWE-287
• CWE-290

• https://github.com/filebrowser/filebrowser/blob/main/auth/proxy.go
• https://github.com/filebrowser/filebrowser/blob/main/http/auth.go#L121-L137
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-xqp3-jq6g-x3qm
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-xqp3-jq6g-x3qm

Published

Jun 25, 2026

Last Modified

Jun 25, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54079veraPDF validation provides PDF/A and PDF/UA validation, fea…8.7
• CVE-2026-5408BT-DHT protocol dissector crash in Wireshark 4.6.0 to 4.6.4 …5.5
• CVE-2026-54080veraPDF PDF parser is a PDF parser for veraPDF. Prior to 1.3…6.9
• CVE-2026-54081veraPDF PDF parser is a PDF parser for veraPDF. Prior to 1.3…6.9
• CVE-2026-54082veraPDF validation model is an implementation of the veraPDF…6.5
• CVE-2026-54088File Browser is a file managing interface for uploading, del…9.3
• CVE-2026-5409Monero protocol dissector crash in Wireshark 4.6.0 to 4.6.4 …5.5
• CVE-2026-54090File Browser is a file managing interface for uploading, del…8.7
• CVE-2026-54091File Browser is a file managing interface for uploading, del…7.5
• CVE-2026-54092File Browser is a file managing interface for uploading, del…6.5
• CVE-2026-54093File Browser is a file managing interface for uploading, del…6.8
• CVE-2026-54094File Browser is a file managing interface for uploading, del…7.5