Improper Authorization in FileBrowser - #VU139764
Published: July 27, 2026
Vulnerability identifier: #VU139764
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: N/A
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: File Browser
Affected software:
FileBrowser
FileBrowser
Detailed vulnerability description
The vulnerability allows a remote user to access protected resources and administrative functionality with an expired token.
The vulnerability exists due to improper access control in the shared authentication middleware when processing requests under proxy authentication with a non-default logout page. A remote user can present an expired but validly signed token to access protected resources and administrative functionality with an expired token.
The issue occurs only when proxy authentication is enabled and auth.logoutPage is set to a non-default value. An expired token can also be exchanged for a fresh token at /api/renew.
Remediation
Install security update from vendor's website.