CVE-2026-72839

9.3 criticalEPSS 0.6%

Critical (9.3). EPSS 0.6% chance of exploitation in the next 30 days.

filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is enabled with default CreateUserDir setting. Unauthenticated attackers can register accounts that inherit the server root scope with full create, modify, delete, rename, share, and download permissions, allowing unrestricted access to all files.

Severity

CVSS 4.0

9.3 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-31)
CWE: CWE-266
Published: 2026-08-13
Modified: 2026-09-08
Record from: the NVD, synced 2026-10-19

References

https://github.com/filebrowser/filebrowser/security/advisories/GHSA-6759-996p-gpj6
https://www.vulncheck.com/advisories/filebrowser-through-privilege-escalation-via-signup
https://github.com/filebrowser/filebrowser/security/advisories/GHSA-6759-996p-gpj6

Check your stack JSON