FileRise: Authentication bypass via OIDC account binding to local accounts
Summary
FileRise, a self-hosted web-based file manager, maps authenticated OIDC identities to local accounts using mutable preferred_username or email claims and does not require email_verified for email-based naming. An attacker who can obtain identity provider claims that collide with an existing local username can log in as that account, including the built-in administrator. This works even when automatic provisioning is disabled, and exploitability depends on whether the configured identity provider issues such colliding claims.
Affected
- error311 FileRise versions before 3.23.0
- Only installations with OIDC login enabled are affected according to the advisory mechanism; local-only login is not affected.
Fixed in
- Fixed in FileRise 3.23.0 (commit cc1118923b522baff28dca05bdd79c27f984c68a).
- Later releases exist; check the vendor release page for the current stable version.
Workaround
- Unknown. The vendor documents no interim workaround.
- Unverified option: disable OIDC login or restrict the identity providers that users can sign in with until the upgrade is complete.
Exploitation
- CISA SSVC: Exploitation 'poc', Automatable 'no', Technical Impact 'total'.
- Not marked as known exploited in the sources reviewed.
- No public proof of concept found in the research; this does not prove none exists.
Our recommendation
- Find out whether any FileRise instance uses OIDC login.
- Upgrade to 3.23.0 or later, preferably the current stable release, after reading the OIDC migration and ONLYOFFICE callback notes in the release.
- Verify a working local administrator login and back up the users directory before upgrading.
- Review admin and account logins since OIDC was enabled, and check for OIDC-linked accounts you do not recognise.
- Patch CVE-2026-104105 and CVE-2026-104106 together with this fix, as they are fixed in the same release.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-c5c5-mv9m-j367 github.com
- FileRise v3.23.0 release github.com
- Fix commit cc11189 github.com
- OSV CVE-2026-104108 osv.dev
- VulDB CVE-2026-104108 vuldb.com
- FileRise changelog filerise.net
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 19:02.
Original description (NVD)
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise maps an authenticated OIDC identity to a local account using mutable preferred_username or email claims and does not require email_verified for email-based naming. An attacker who can obtain provider-issued claims colliding with an existing local username can be logged in as that account, including the built-in administrator, even when automatic provisioning is disabled. Exploitability depends on the configured identity provider allowing the colliding claim. This issue is fixed in version 3.23.0.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.