CVE-2026-72837 in File Browser
Summary
by MITRE • 08/14/2026
File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope assignment.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/14/2026
The vulnerability described in this CVE affects File Browser versions prior to 2.63.20 and represents a critical authorization bypass flaw that undermines fundamental security isolation mechanisms within the application's authentication system. This issue specifically impacts the proxy and hook authentication auto-provisioning paths where the system fails to properly enforce user directory isolation. The root cause lies in how the application handles server root scope assignment during authentication processes, creating a pathway for privilege escalation through improper access control enforcement.
The technical flaw manifests when legitimate users authenticate through proxy or hook mechanisms and the system incorrectly assigns them server root scope permissions instead of maintaining proper per-user directory boundaries. This misconfiguration allows authenticated attackers to traverse file system boundaries and gain access to resources belonging to other users within the same File Browser instance. The vulnerability specifically exploits the createUserDir functionality that should normally create isolated user directories but fails to properly enforce these boundaries in the auto-provisioning workflows.
From an operational impact perspective, this vulnerability creates a severe data exposure risk where attackers can perform unauthorized read, modify, delete, and share operations across multiple user accounts simultaneously. The implications extend beyond simple data theft to include potential data corruption, privilege escalation attacks, and cross-user data leakage that could compromise entire organizational file repositories. This flaw essentially nullifies the intended security model of isolated user environments, making it particularly dangerous in multi-tenant or shared hosting scenarios where multiple users rely on separate file spaces.
The vulnerability aligns with CWE-284 Access Control Issues, specifically targeting improper access control enforcement within authentication mechanisms. It also maps to ATT&CK techniques such as T1078 Valid Accounts for maintaining persistence and T1566 Phishing for initial compromise, as attackers would need valid upstream credentials to exploit this flaw. Organizations using File Browser versions prior to 2.63.20 face significant risk of unauthorized data access and potential regulatory compliance violations due to the exposure of sensitive user information across multiple accounts.
Mitigation strategies should prioritize immediate patching to version 2.63.20 or later where the authentication isolation has been properly implemented. Administrators should also implement additional monitoring for unusual file access patterns, particularly around user directory boundaries. Network segmentation and least-privilege access controls should be enforced at the infrastructure level to limit potential impact if exploitation occurs. Regular security audits of authentication flows and access control configurations should be conducted to identify similar issues in other applications that may exhibit similar authorization bypass vulnerabilities.