{"cve":"CVE-2026-54089","nvd":{"published":"2026-06-25T19:16:40.827","modified":"2026-06-25T19:58:30.847","status":"Deferred","description":"File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Starting with 2.0.0-rc.1, when FileBrowser is configured with proxy authentication (auth.method=proxy), any unauthenticated attacker who can reach the server directly can impersonate any user - including admin - by sending a single forged HTTP header. No credentials are required. Additionally, specifying a non-existent username causes the server to automatically create a new user account, providing an account creation primitive with no authorization. This is an already known issue that has been documented in the documentation for several years, but has not been documented as a vulnerability before.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":9.1},"cwes":["CWE-287","CWE-290"],"references":["https://github.com/filebrowser/filebrowser/blob/main/auth/proxy.go","https://github.com/filebrowser/filebrowser/blob/main/http/auth.go#L121-L137","https://github.com/filebrowser/filebrowser/security/advisories/GHSA-xqp3-jq6g-x3qm","https://github.com/filebrowser/filebrowser/security/advisories/GHSA-xqp3-jq6g-x3qm"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:41:17.107060303+00:00"},"epss":{"cve":"CVE-2026-54089","score":0.00612,"percentile":0.4932,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-xqp3-jq6g-x3qm","url":"https://osv.dev/vulnerability/GHSA-xqp3-jq6g-x3qm","summary":"File Browser: Authentication Bypass via Proxy Auth Header Forgery","modified":"2026-07-21T19:19:25.878288652Z","packages":[{"ecosystem":"Go","name":"github.com/filebrowser/filebrowser/v2","purl":"pkg:golang/github.com/filebrowser/filebrowser/v2","ranges":[">=2.0.0-rc.1 <=2.63.18"],"fixed":[]}]},{"id":"GO-2026-5966","url":"https://osv.dev/vulnerability/GO-2026-5966","summary":"File Browser: Authentication Bypass via Proxy Auth Header Forgery in github.com/filebrowser/filebrowser","modified":"2026-07-21T19:15:30.719268281Z","packages":[{"ecosystem":"Go","name":"github.com/filebrowser/filebrowser","purl":"pkg:golang/github.com/filebrowser/filebrowser","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/filebrowser/filebrowser/v2","purl":"pkg:golang/github.com/filebrowser/filebrowser/v2","ranges":[">=2.0.0-rc.1"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}