CVE-2026-69193 in FileRise
Summary
by MITRE • 10/15/2026
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.21.0, FileRise tracks failed logins only by the combination of source IP address and username. A remote unauthenticated attacker can rotate usernames to obtain a fresh per-account attempt budget for each name, enabling password spraying from one source beyond the intended limit. Per-user limits still apply and can also produce distinguishable throttling behavior for targeted accounts. The affected surface is AuthModel::getFailedLoginKey(). This issue is fixed in version 3.21.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/15/2026
FileRise is a self-hosted web-based file management solution that provides users with capabilities such as multi-file upload, editing, and batch operations. The application includes security mechanisms designed to prevent brute-force attacks by tracking failed login attempts. However, prior to version 3.21.0, the implementation of these rate-limiting controls contained a significant architectural flaw in how it identified and throttled authentication failures. Specifically, the system relied on AuthModel::getFailedLoginKey() to generate unique identifiers for tracking unsuccessful login events. This function constructed its key based solely on the combination of the source IP address and the target username. While this approach aims to balance security with usability by allowing legitimate users from shared networks or dynamic IPs to eventually regain access, it introduces a critical bypass vector when combined with multiple valid usernames.
The core technical flaw lies in the granularity of the rate-limiting logic. Because the failure counter is scoped per user rather than strictly per IP address for all authentication attempts, an unauthenticated attacker can exploit this by rotating through different valid usernames while maintaining a single source IP address. By submitting login requests with distinct usernames, the attacker effectively resets or bypasses the per-account attempt budget for each new username tried. This allows the adversary to perform password spraying attacks from one network location without triggering the global rate limits that would typically block repeated failures from a single IP against any account. The intended limit is thus circumvented because the system treats each username as an independent entity regarding failure tracking, provided they originate from different identities within the same session or source context.
From an operational impact perspective, this vulnerability significantly lowers the barrier for credential stuffing and password spraying campaigns. Attackers can systematically test large lists of common passwords against multiple user accounts without being detected by traditional IP-based throttling mechanisms. Although per-user limits still apply to individual accounts, these limits are often set high enough to allow hundreds or thousands of attempts before locking out a specific account. Furthermore, the distinguishable throttling behavior for targeted accounts can inadvertently aid attackers in enumerating valid usernames; if one username triggers immediate lockout while others do not, it confirms the existence and validity of that user identity within the system. This information leakage facilitates further targeted attacks against high-value targets once their identities are confirmed.
This vulnerability aligns with CWE-307 Improper Restriction of Excessive Authentication Attempts, as the application fails to adequately restrict the number of authentication attempts from a single source when multiple accounts are involved. It also relates to CWE-640 Weak Password Recovery Mechanisms for Forgotten Passwords in the broader context of account security hygiene, though primarily it is an access control failure regarding brute-force mitigation. In terms of MITRE ATT&CK framework mapping, this flaw enables techniques associated with T1110 Brute Force and specifically supports password spraying tactics where attackers attempt common passwords against many accounts to avoid detection by rate-limiting systems designed for traditional brute force patterns.
To mitigate this vulnerability, organizations running FileRise versions prior to 3.21.0 should immediately upgrade to version 3.21.0 or later, which addresses the flaw in AuthModel::getFailedLoginKey(). For environments where upgrading is not immediately feasible, administrators can implement compensating controls at the network perimeter level. Deploying a Web Application Firewall (WAF) with advanced rate-limiting rules that monitor aggregate authentication failure rates across all usernames from a single IP address can help detect and block suspicious spraying activity. Additionally, implementing CAPTCHA challenges after a small number of failed attempts regardless of username diversity can disrupt automated attacks. Enforcing strong password policies and enabling multi-factor authentication further reduces the risk posed by successful credential guessing, ensuring that even if passwords are compromised through this method, unauthorized access remains blocked.