CVE-2026-72839CWE-266

CVE-2026-72839

Critical · published August 14, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
46.7
In the wild
Unconfirmed
What it is

filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is enabled with default CreateUserDir setting. Unauthenticated attackers can register accounts that inherit the server root scope with full create, modify, delete, rename, share, and download permissions, allowing unrestricted access to all files.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00574 · 46.7th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2026-08-14T02:17Z
References (3)
https://github.com/filebrowser/filebrowser/security/advisories/GHSA-6759-996p-gpj6 · [email protected]https://www.vulncheck.com/advisories/filebrowser-through-privilege-escalation-via-signup · [email protected]https://github.com/filebrowser/filebrowser/security/advisories/GHSA-6759-996p-gpj6 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 13 AUG 21:54Z
    filebrowser through 2.63.16 Privilege Escalation via Signup
    cvelistv5