Description

filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is enabled with default CreateUserDir setting. Unauthenticated attackers can register accounts that inherit the server root scope with full create, modify, delete, rename, share, and download permissions, allowing unrestricted access to all files.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-13T22:17:23.490Z",
  "pubdate": "2026-08-13T22:17:23.490Z",
  "executiveSummary": "A scope and permission restriction vulnerability exists in filebrowser through 2.63.16 when self-signup is enabled in conjunction with the default CreateUserDir setting. This security flaw allows unauthenticated remote attackers to register new accounts via the self-service registration mechanism. Newly created accounts improperly inherit the global server root scope alongside full administrative capabilities, encompassing unrestricted create, modify, delete, rename, share, and download permissions.\nThe primary impact of this vulnerability is complete compromise of the underlying filesystem accessible to the application, exposing sensitive data and critical system files to unauthorized users. The vulnerability affects filebrowser deployments utilizing default user directory creation configurations combined with active self-signup functionality. Risk implications are critical due to the lack of required authentication and privileges needed to execute the attack. Unauthenticated attackers can instantly provision high-privilege accounts without interacting with administrative interfaces or bypassing complex cryptographic controls, leading to total confidentiality, integrity, and availability loss for hosted file resources.",
  "technicalDetails": "The vulnerability stems from improper access control enforcement and flawed scope inheritance logic within the user registration subsystem of filebrowser through 2.63.16. Specifically, when self-signup is enabled and the default CreateUserDir configuration is active, the application fails to correctly constrain newly provisioned user scopes to isolated subdirectories. Instead of bounding the newly registered user's operational boundaries to a restricted home directory, the application assigns the server root scope to the newly created security context.\nThe exploitation method requires zero authentication and no prior privileges. An attacker initiates the attack flow by querying the publicly exposed self-signup endpoint of the filebrowser instance. By submitting a registration payload, the attacker successfully provisions a standard user account. Due to the logic defect in scope assignment under the default CreateUserDir setting, the newly generated session and associated user profile are granted elevated permissions over the entire server root.\nThe attack flow proceeds as follows: First, the adversary identifies an exposed filebrowser instance where self-signup is active. Second, the attacker interacts with the user registration functionality to create an unauthorized account. Third, upon successful registration, the application instantiates the user profile without applying the intended scope restrictions tied to the CreateUserDir parameter. Fourth, the attacker authenticates using the newly registered credentials and issues API requests targeting global file paths. Finally, the application processes these requests against the server root scope, permitting full create, modify, delete, rename, share, and download operations across all accessible directories and files.\nThe vulnerable components reside within the user management, scope enforcement, and self-registration modules of filebrowser. Affected versions include all releases through 2.63.16. Network exposure is direct, as the self-signup functionality is typically accessible over HTTP or HTTPS via standard web interfaces. Post-exploitation impact includes unauthorized data exfiltration, modification or destruction of critical system data, and potential lateral movement or further system compromise depending on the privileges of the underlying filebrowser system process."
}