CVE-2026-72834

filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum (?checksum=) branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check (unlike the sibling raw, preview, and subtitle paths). As a result, an authenticated user provisioned with Perm.Download=false can obtain a content-hash oracle for any same-scope file (md5/sha1/sha256/sha512), enabling confirmation of known/guessed content, change detection, and offline brute-force of low-entropy files. This is an incomplete fix of CVE-2026-35606; it bypasses only the Download permission and does not defeat scope/path authorization.

• CWE-200

• https://github.com/filebrowser/filebrowser/commit/b7dc392838f11d188f0bc0f2a1a99fad3f7dca03
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-7whw-q6gh-xr59
• https://www.vulncheck.com/advisories/filebrowser-before-permission-bypass-via-checksum

Published

Aug 14, 2026

Last Modified

Sep 8, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-72829The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 …8.8
• CVE-2026-7283A security flaw has been discovered in SourceCodester Pharma…4.7
• CVE-2026-72830Grav API plugin versions before 1.0.13 fail to enforce API k…8.8
• CVE-2026-72831The Flex Objects plugin (through 1.4.6, tested with Grav 2.0…8.8
• CVE-2026-72832Grav versions from 1.5.2 through 2.0.12 contain a stored cro…5.4
• CVE-2026-72833The Grav API plugin (getgrav/grav-plugin-api) versions >= 1.…8.8
• CVE-2026-72835filebrowser versions before v2.63.21 fail to canonicalize pa…6.8
• CVE-2026-72836FileBrowser before 2.63.19 does not account for case-insensi…8.1
• CVE-2026-72837File Browser versions before 2.63.20 fail to honor the creat…8.8
• CVE-2026-72838FileBrowser versions before 2.63.19 fail to enforce the decl…6.5
• CVE-2026-72839filebrowser through 2.63.16 fails to properly restrict scope…9.8
• CVE-2026-7284The Easy Elements for Elementor – Addons & Website Templates…9.8