CVE-2026-57493GHSA-r55g-3hcc-6jx7
FileRise: Remember-me auto-login uses stale admin role from token instead of current role
error311 FileRise
CVSS
6.8MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 20 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 13% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3.16.0error311/FileRiseGitHub
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise stores the isAdmin flag in remember-me tokens and restores that stale value during automatic login instead of resolving the account's current role from users.txt. A user who was issued a token while an administrator can retain administrator access after demotion, and token rotation copies the stale privilege into each replacement token. Exploitation requires possession of the pre-demotion remember-me token. This issue is fixed in version 3.16.0.
Text from CVE List
Affected versions 2
- FileRiseaffected: < 3.16.0CVE List
- error311/FileRise≤ 3.15.0GitHub