CVE-2026-104106 in FileRise
Summary
by MITRE • 10/14/2026
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise permits an authenticated session with a valid CSRF token to disable TOTP without recent full reauthentication or to begin enrollment when the account currently has no TOTP secret. The enrollment endpoint returns 409 rather than directly overwriting an already configured secret, but it persists and activates a newly generated secret before a TOTP code verifies possession. An attacker controlling an existing authenticated session can therefore disable an existing second factor or enroll one after the account has no configured secret; this is not a direct overwrite of an active authenticator. This issue is fixed in version 3.23.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/14/2026
FileRise is a self-hosted web-based file management solution that provides features such as multi-file upload, editing capabilities, and batch operations for users managing digital assets within their own infrastructure. The application relies on standard authentication mechanisms to secure user accounts, often supplemented by two-factor authentication (2FA) using Time-Based One-Time Passwords (TOTP) to enhance security posture. In versions prior to 3.23.0, the implementation of these security controls contains a critical flaw related to how session management and CSRF token validation interact with TOTP configuration endpoints. This vulnerability allows an attacker who has obtained or controlled an authenticated session for a victim user to manipulate the account's second-factor authentication settings without requiring recent full reauthentication through all primary factors.
The core technical flaw lies in the insufficient verification of intent during critical state changes involving security credentials. Specifically, when a valid CSRF token is present alongside an active authenticated session, the application permits two distinct but related malicious actions. First, it allows the disabling of TOTP without requiring the user to re-enter their password or provide additional proof of identity beyond the existing session cookie and CSRF token. Second, if the account currently has no configured TOTP secret, the enrollment endpoint can be triggered to begin a new enrollment process. Although the API returns an HTTP 409 Conflict status code when attempting to overwrite an already active secret, this response does not prevent the side effect of persisting and activating a newly generated secret before any verification step occurs. This means that even if the operation is technically blocked due to conflict, the system may still register or activate new cryptographic material in a state where it can be exploited by the attacker controlling the session.
From an operational impact perspective, this vulnerability significantly undermines the security guarantees provided by two-factor authentication. An adversary with access to a valid authenticated session, which might be achieved through cross-site scripting (XSS), session hijacking via network interception if TLS is not enforced or terminated improperly, or social engineering leading to cookie theft, can effectively neutralize TOTP protections. By disabling TOTP, the attacker removes the second layer of defense, leaving only the password as a barrier. Alternatively, by enrolling their own TOTP secret when none exists, the attacker gains persistent access that survives session expiration and allows them to bypass future login attempts using their own generated codes. This is not merely an overwrite issue but a fundamental failure in ensuring that changes to security-critical configurations require explicit, recent user consent through strong reauthentication mechanisms such as password entry or biometric verification.
This vulnerability aligns with CWE-352, Cross-Site Request Forgery (CSRF), due to the reliance on session cookies and CSRF tokens without adequate secondary validation for sensitive state-changing operations. It also relates to CWE-640, Weak Password Recovery Mechanisms for Administrators, in a broader sense of weak identity verification during credential management, though more accurately it falls under CWE-287, Improper Authentication, because the system fails to verify that the user initiating the change is indeed the legitimate account holder through robust means. In terms of MITRE ATT&CK mapping, this behavior facilitates Account Manipulation (T1098) as an attacker modifies authentication methods to maintain access, and potentially Credential Access (T1556) if the TOTP secret generation or storage involves weak cryptographic practices that could be leveraged further.
To mitigate this vulnerability, organizations using FileRise must upgrade immediately to version 3.23.0 where these logic flaws have been addressed. For environments unable to patch instantly due to operational constraints, temporary mitigations should include enforcing strict session timeouts and requiring reauthentication via password entry for any changes to security settings such as TOTP enrollment or disabling. Additionally, implementing additional CSRF protection layers such as custom request headers validated on the server side can reduce the risk of exploitation if an attacker manages to obtain a valid session token through XSS vulnerabilities. Regular audits of authentication flows and ensuring that critical configuration changes always trigger multi-factor re-verification are essential best practices for maintaining robust identity security in self-hosted applications.