error311 FileRise up to 3.15.x Remember-Me Token users.txt isAdmin privileges management

Summaryinfo

A vulnerability has been found in error311 FileRise up to 3.15.x and classified as critical. Impacted is an unknown function of the file users.txt of the component Remember-Me Token. Performing a manipulation of the argument isAdmin results in privileges management. This vulnerability is identified as CVE-2026-57493. The attack can be initiated remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as critical has been found in error311 FileRise up to 3.15.x. This affects an unknown part of the file users.txt of the component Remember-Me Token. The manipulation of the argument isAdmin with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise stores the isAdmin flag in remember-me tokens and restores that stale value during automatic login instead of resolving the account's current role from users.txt. A user who was issued a token while an administrator can retain administrator access after demotion, and token rotation copies the stale privilege into each replacement token. Exploitation requires possession of the pre-demotion remember-me token. This issue is fixed in version 3.16.0.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-57493 since 06/24/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1068 for this issue.

By approaching the search of inurl:users.txt it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 3.16.0 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• error311

Name

• FileRise

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12
• 3.13
• 3.14
• 3.15

Website

• Product: https://github.com/error311/FileRise/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion