CVE-2026-69191

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.21.0, FileRise enforces disableFormLogin, disableBasicAuth, and disableOIDCLogin in the client interface but not consistently in the corresponding server-side authentication flows. A user with otherwise valid credentials for a disabled method can call its backend endpoint directly and authenticate despite the administrator's login-method policy. The flaw does not permit credential-free authentication. This issue is fixed in version 3.21.0.

• CWE-287

• https://github.com/error311/FileRise/commit/613fdb28ca25e6dcc9bdfa590757b53935fad8da
• https://github.com/error311/FileRise/releases/tag/v3.21.0
• https://github.com/error311/FileRise/security/advisories/GHSA-p9qc-2r93-jccq

Published

Oct 14, 2026

Last Modified

Oct 15, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-69184c-ares is an asynchronous resolver library. Prior to 1.34.7,…7.5
• CVE-2026-69185Socket.IO enables bidirectional and low-latency communicatio…7.5
• CVE-2026-69186c-ares is an asynchronous resolver library. Prior to 1.34.7,…5.3
• CVE-2026-69189Hoppscotch is an open source API development ecosystem. Prio…7.6
• CVE-2026-6919Use after free in DevTools in Google Chrome prior to 147.0.7…9.6
• CVE-2026-69190Graylog is a free and open log management platform. From 6.3…6.3
• CVE-2026-69192ip-address is a library for parsing and manipulating IPv4 an…7.7
• CVE-2026-69193FileRise is a self-hosted web-based file manager with multi-…6.5
• CVE-2026-69194FileRise is a self-hosted web-based file manager with multi-…4.8
• CVE-2026-69197Umbraco is an ASP.NET CMS. Prior to 13.15.1, 17.5.3, and 18.…8.7
• CVE-2026-69198ip-address is a library for parsing and manipulating IPv4 an…6.9
• CVE-2026-6920Out of bounds read in GPU in Google Chrome on Android prior …9.6