CVE-2026-86934 in FileMaker Server
Summary
by MITRE • 09/23/2026
An authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed requests containing an extended privilege header to bypass the disabled Custom Web Publishing with XML setting and access the XML Web Publishing interface. This vulnerability is addressed in FileMaker Server version 26.0.3.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/23/2026
The identified security flaw resides within the FileMaker Server Web Publishing Engine, specifically affecting how authentication headers are processed when interacting with disabled web publishing interfaces. The core technical issue involves an authorization bypass where requests containing a specific extended privilege header were incorrectly permitted to access the XML Web Publishing interface despite administrative settings explicitly disabling Custom Web Publishing via XML. This indicates a failure in the server's request filtering logic, which failed to enforce the global configuration state when processing incoming HTTP requests that included elevated permission indicators. The vulnerability essentially allows an attacker to circumvent intended security controls by leveraging specific header values that trick the engine into treating the disabled service as active or accessible under certain privilege conditions.
From a technical perspective, this represents a classic access control failure where the system does not consistently validate global configuration states against individual request attributes. By including an extended privilege header in the HTTP request, an actor can manipulate the server's internal decision-making process to grant access that should have been universally denied based on the disabled XML publishing setting. This bypass mechanism highlights a gap in how the Web Publishing Engine parses and prioritizes headers versus static configuration flags, allowing unauthorized interaction with backend data structures through the XML interface even when such access is explicitly prohibited by administrators.
The operational impact of this vulnerability is significant for organizations relying on FileMaker Server to manage sensitive business data. An attacker exploiting this flaw could gain unauthorized read or write access to database records via the XML API, potentially leading to data exfiltration, modification, or deletion depending on the privileges associated with the extended privilege header used in the attack vector. Since Custom Web Publishing often provides direct programmatic access to the underlying filemaker data model, bypassing its disablement effectively opens a backdoor into the core application logic and stored information without requiring valid user credentials for standard web publishing methods.
This vulnerability aligns closely with CWE-284 Improper Access Control, as it involves failing to enforce proper restrictions on authenticated users or external actors regarding access rights. Additionally, from an offensive security framework perspective, such behavior is consistent with ATT&CK technique T1078 Valid Accounts if the extended privilege header implies valid but misused credentials, or more broadly with unauthorized API access patterns where configuration settings are ignored during request processing. The exploitation does not require complex buffer overflow techniques or memory corruption errors but rather relies on logical flaws in how authorization headers interact with service enablement states.
Mitigation for this issue is primarily addressed through software updates provided by the vendor. Organizations running FileMaker Server must upgrade to version 26.0.3 or later, where the logic governing the interaction between extended privilege headers and disabled web publishing settings has been corrected to ensure that global disablement flags are strictly enforced regardless of incoming header values. Until such an update is applied, administrators should consider network-level controls such as firewall rules to restrict access to the Web Publishing Engine ports from untrusted networks or implement strict input validation at a reverse proxy layer if possible, although these are compensatory measures rather than definitive fixes for the underlying application logic flaw.