Improper access control in FileBrowser - CVE-2026-73611
Published: July 27, 2026 / Updated: September 14, 2026
Vulnerability identifier: #VU139762
CSH Severity: Low
CVSS v4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-73611
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to access protected routes and renew expired sessions.
The vulnerability exists due to improper access control in the shared authentication middleware when handling requests with an expired but validly signed JWT under proxy authentication with a non-default logout page. A remote user can present a previously valid signed token to access protected routes and renew expired sessions.
Administrative routes are affected when the token belongs to an administrator, and exploitation requires proxy authentication with a non-default auth.logoutPage configuration.
Affected software
FileBrowser
How to mitigate CVE-2026-73611
Install security update from vendor's website.
FileBrowser - update to 2.63.22