CVE-2026-32761

File Browser has an Authorization Policy Bypass in its Public Share Download Flow

CVSS 3.1 6.5 MEDIUMEUVD CVSS 3.1 6.5 CVSS 3.1 · [email protected] · Secondary 6.5 MEDIUMCVSS_V3 Publisher rating MODERATEosv · severity unknownFixed by github.com/filebrowser/filebrowser/v2 2.62.0KEV status unknown

Original advisory

cve-program · CVE-2026-32761

Published

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Versions 2.61.0 and below contain a permission enforcement bypass which allows users who are denied download privileges (perm.download = false) but granted share privileges (perm.share = true) to exfiltrate file content by creating public share links. While the direct raw download endpoint (/api/raw/) correctly enforces the download permission, the share creation endpoint only checks Perm.Share, and the public download handler (/api/public/dl/<hash>) serves file content without verifying that the original file owner has download permission. This means any authenticated user with share access can circumvent download restrictions by sharing a file and then retrieving it via the unauthenticated public download URL. The vulnerability undermines data-loss prevention and role-separation policies, as restricted users can publicly distribute files they are explicitly blocked from downloading directly. This issue has been fixed in version 2.62.0.

Read the publisher's advisory

euvd · EUVD-2026-13412

Published

Read the publisher's advisory

nvd · CVE-2026-32761

Published

Read the publisher's advisory

osv · GHSA-68j5-4m99-w9w9

Published

### Summary A permission enforcement flaw allows users without download privileges (`download=false`) to still expose and retrieve file content via public share links when they retain share privileges (`share=true`). This bypasses intended access control policy and enables unauthorized data exfiltration to unauthenticated users. Where download restrictions are used for data-loss prevention or role separation. ### Details The backend applies inconsistent authorization checks across download paths: - Direct raw download correctly enforces `Perm.Download`: - [[raw.go](https://github.com/filebrowser/filebrowser/blob/master/http/raw.go#82)](filebrowser/http/raw.go:82) - Share creation only enforces `Perm.Share`: - [[share.go](https://github.com/filebrowser/filebrowser/blob/master/http/share.go#21)](filebrowser/http/share.go:21) - Public share/download handlers serve shared content without verifying owner `Perm.Download`: - [public.go](https://github.com/filebrowser/filebrowser/blob/master/http/public.go#18)(filebrowser/http/public.go:18) - [public.go](https://github.com/filebrowser/filebrowser/blob/master/http/public.go#116)(filebrowser/http/public.go:116) As a result, a user who is blocked from direct downloads can create a share and obtain the same file via `/api/public/dl/<hash>`. ### PoC 1. Create a non-admin user with: - `perm.share = true` - `perm.download = false` 2. Login as that user and upload a **PDF** file: - `POST /api/resources/nodl_secret_<rand>.pdf` with `Content-Type: application/pdf` 3. Verify direct raw download is denied: - `GET /api/raw/nodl_secret_<rand>.pdf` - Expected and observed: `202 Accepted` (blocked) 4. Create share for same file: - `POST /api/share/nodl_secret_<rand>.pdf` - Observed: `200`, response includes `hash` (example: `qxfK3JMG`) 5. Download publicly without authentication: - `GET /api/public/dl/<hash>` - Observed (vulnerable): `200`, `Content-Type: application/pdf`, and PDF bytes are returned Live evidence captured (March 1, 2026): - `create user`: `201` - `create file`: `200` - `direct /api/raw`: `202 Accepted` - `create share`: `200` - `public download /api/public/dl/mxK-ppZb`: `200` - `public download content-type`: `application/pdf` - `public download body length`: `327` bytes ### Impact This is an **access control / authorization policy bypass** vulnerability. - **Who can exploit:** Any authenticated user granted `share=true` but denied `download`. - **Who is impacted:** Operators and organizations relying on download restrictions to prevent data export. - **What can happen:** Restricted users can still distribute and retrieve files publicly, including unauthenticated access through share URLs.

Read the publisher's advisory

osv · GO-2026-4738

Published

File Browser has an Authorization Policy Bypass in Public Share Download Flow in github.com/filebrowser/filebrowser

Read the publisher's advisory

Affected versions, risk and source history

Exploitation and risk

Source status

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

Which CVEs have scores here?

This view includes predictions for CVE identifiers explicitly listed in public NuGet advisories. Microsoft release pages have their own prediction coverage. Check source status for the scope and latest checks.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

Risk history

Compare earlier KEV listings and daily EPSS scores. Advisory wording and affected versions have a separate history.

When does an EPSS score appear as a change?

A prediction change is reported when EPSS rises from below 10% to 10% or higher. Other daily score changes remain in this history.

Advisory history

14 saved versions

See how the publisher's advisory changed over time. Each link opens the version saved at that time. The publisher's update date can differ from the date shown here.

How advisory history works

Each link identifies one complete publisher record. History can include advisories that previously shared an identifier; an identifier removed by a publisher no longer establishes a current relationship. A historical link shows only that record and earlier saved versions. Failed checks and unchanged reads do not create new versions.

15 Nov 2026 09:36:30 UTC