6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32761

CVE-2026-32761: File Browser has an Authorization Policy Bypass in its Public Share Download Flow

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Versions 2.61.0 and below contain a permission enforcement bypass which allows users who are denied download privileges (perm.download = false) but granted share privileges (perm.share = true) to exfiltrate file content by creating public share links. While the direct raw download endpoint (/api/raw/) correctly enforces the download permission, the share creation endpoint only checks Perm.Share, and the public download handler (/api/public/dl/<hash>) serves file content without verifying that the original file owner has download permission. This means any authenticated user with share access can circumvent download restrictions by sharing a file and then retrieving it via the unauthenticated public download URL. The vulnerability undermines data-loss prevention and role-separation policies, as restricted users can publicly distribute files they are explicitly blocked from downloading directly. This issue has been fixed in version 2.62.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32761

CVE-2026-32761:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
https://github.com/filebrowser/filebrowser	go	<= 2.61.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an authorization bypass in the file-sharing mechanism of File Browser. The root cause is an insufficient permission check in the withPermShare function located in http/share.go. This middleware function was responsible for authorizing the creation of public share links. In the vulnerable versions, it only verified if a user had Perm.Share, completely omitting a check for Perm.Download.

This flaw allowed a malicious or compromised user, who is explicitly denied download privileges, to generate a public, unauthenticated download link for any file they have access to. The exploitation is completed by accessing the public download endpoints, handled by handler.ServeHTTP and handler.download in http/public.go. These handlers do not perform any secondary permission checks on the file owner at the time of the download; they operate under the assumption that a valid share link is sufficient authorization.

The patch, committed in version 2.62.0, rectifies this by adding the necessary !d.user.Perm.Download check within the withPermShare function. This ensures that a user must have both share and download permissions to create a shareable link, effectively closing the bypass.

Vulnerable functions

withPermShare

http/share.go

This function serves as a middleware for creating share links. The vulnerability lies in its failure to check for the user's download permission (`Perm.Download`) before allowing the creation of a share. It only verified the share permission (`Perm.Share`), enabling a user without download rights to generate a public link to a file, thus bypassing the intended security policy.

handler.ServeHTTP

http/public.go

This function is the entry point for handling public share requests. It is part of the vulnerable process because it processes requests for public downloads without validating the original file owner's download permissions. It routes the request to the download handler, trusting the validity of the share link.

handler.download

http/public.go

This function is responsible for serving the actual file content for a public download link. It is a key component in the exploit chain as it delivers the file to the user without checking if the user who created the share had the permission to download. This allows unauthorized data access via the `/api/public/dl/<hash>` endpoint.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.