CVE-2026-104108 in FileRise
Summary
by MITRE • 10/14/2026
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise maps an authenticated OIDC identity to a local account using mutable preferred_username or email claims and does not require email_verified for email-based naming. An attacker who can obtain provider-issued claims colliding with an existing local username can be logged in as that account, including the built-in administrator, even when automatic provisioning is disabled. Exploitability depends on the configured identity provider allowing the colliding claim. This issue is fixed in version 3.23.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
FileRise operates as a self-hosted web-based file management solution that supports multi-file uploads, editing capabilities, and batch operations for organizational data handling. The security architecture relies on OpenID Connect (OIDC) to map external identity provider claims to local user accounts within the application. This mapping process is critical because it determines which internal permissions and access levels are assigned to a given session. In versions prior to 3.23.0, the implementation of this account linking mechanism contains a significant logical flaw related to how unique identifiers for local accounts are derived from external identity claims. Specifically, the system utilizes mutable attributes such as preferred_username or email addresses provided by the OIDC provider to create or identify corresponding local user profiles. This design choice introduces a risk because these claim values can often be controlled or influenced by the end-user through their identity provider settings, rather than being immutable identifiers like unique subject IDs.
The core technical vulnerability stems from the application's failure to enforce strict uniqueness constraints and validation on the claims used for account mapping. When an authenticated user logs in via OIDC, FileRise checks if a local account exists with a matching preferred_username or email claim. If no such account is found, it may automatically provision one based on that value; if one does exist, it maps the session to that existing account. Crucially, the software did not require the email_verified flag to be true when using an email address for this mapping process. This omission allows an attacker who controls a legitimate OIDC identity provider account to manipulate their preferred_username or email claim values. By setting these claims to match the username of an existing local user in FileRise, including high-privilege accounts such as the built-in administrator, the application incorrectly associates the new authentication session with that target's profile. This bypasses standard access controls because the system trusts the external identity provider's assertion without sufficient internal validation or verification steps.
The operational impact of this vulnerability is severe, particularly in environments where automatic user provisioning is disabled but account linking via claims remains active. An attacker can achieve unauthorized administrative access by simply configuring their OIDC profile to mimic an existing administrator's username or email address. Upon authentication, the application grants the session all privileges associated with that local account, effectively granting full control over the file manager and any data stored within it. This constitutes a direct compromise of integrity and confidentiality for sensitive organizational files. The exploitability is contingent upon the specific configuration of the identity provider being used; if the OIDC server allows users to freely edit their preferred_username or email fields without requiring verification, the attack vector becomes readily accessible. Even in scenarios where automatic provisioning is turned off, the account linking logic remains vulnerable because it still relies on these mutable claims for identification rather than stable, immutable identifiers like the sub claim.
This vulnerability aligns with CWE-287, which describes Improper Authentication, specifically involving misidentification of a user due to flawed identity mapping logic. It also relates to CWE-640, Weak Password Recovery Mechanisms for Administrators, insofar as it allows an attacker to assume administrative privileges through credential manipulation rather than brute force or password theft. From the perspective of the MITRE ATT&CK framework, this behavior is consistent with T1078, Valid Accounts, where attackers use legitimate credentials obtained from external sources to gain initial access and escalate privileges by exploiting trust relationships between systems. The lack of verification for email claims further exacerbates the risk, as it violates best practices outlined in OIDC specifications which recommend relying on verified attributes or immutable subject identifiers for account linking.
To mitigate this vulnerability, organizations must upgrade FileRise to version 3.23.0 or later, where the developers have addressed these flaws by implementing stricter validation and likely shifting reliance toward more stable identity claims. In the interim, administrators should configure their OIDC providers to prevent users from modifying critical identifying attributes such as preferred_username after initial registration. Additionally, enabling email verification requirements for all accounts linked via OIDC can reduce the risk of claim collision attacks. It is also advisable to audit existing user configurations to ensure that no local usernames or emails are easily guessable or match common external identity provider defaults. Regularly reviewing authentication logs for unusual login patterns from multiple IP addresses using similar identifiers can help detect potential exploitation attempts before significant damage occurs.