CVE-2026-32761: 
NixOS vulnerability analysis and mitigation

CVE-2026-32761 is an authorization policy bypass vulnerability in File Browser, a web-based file management interface, that allows authenticated users with share privileges but denied download access to exfiltrate file content via public share links. It affects all versions up to and including 2.61.0, and was disclosed on March 17, 2026, with a fix released in version 2.62.0. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (Github Advisory, Security Advisory).

The root cause is inconsistent authorization enforcement across download-related API endpoints, classified as CWE-284 (Improper Access Control), CWE-639 (Authorization Bypass Through User-Controlled Key), and CWE-863 (Incorrect Authorization). Specifically, the direct raw download endpoint (/api/raw/) correctly checks Perm.Download, but the share creation handler (/api/share/) only validates Perm.Share, and the public download handler (/api/public/dl/<hash>) serves file content without verifying the originating user's download permission. An authenticated user with perm.share = true and perm.download = false can exploit this by creating a share link and then retrieving the file via the unauthenticated public download URL, completely bypassing the intended download restriction. The fix in commit 09a2616 modifies http/share.go to require both Perm.Share and Perm.Download before allowing share creation (Security Advisory, Fix Commit).

Successful exploitation results in a high confidentiality impact, allowing restricted users to exfiltrate any file they have access to within the File Browser directory, including sensitive documents, configuration files, or proprietary data. The bypass also enables unauthenticated third parties to access the shared files via the public download URL, effectively making restricted content publicly accessible. There is no integrity or availability impact, but the vulnerability directly undermines data-loss prevention (DLP) and role-separation policies enforced by administrators (Github Advisory, Security Advisory).

A detailed 5-step proof-of-concept (PoC) is publicly available in the GitHub Security Advisory, demonstrating the full exploitation flow with specific HTTP methods, endpoints, expected status codes, and live evidence captured on March 1, 2026. Exploitation requires low privileges (an authenticated account with perm.share = true) and no user interaction. The EPSS score is approximately 0.027%, and there is no evidence of active in-the-wild exploitation or CISA KEV catalog listing as of the time of disclosure (Security Advisory, Github Advisory).

1. Identify a target: Locate a File Browser instance running version ≤2.61.0 where a user account exists with perm.share = true and perm.download = false.
2. Authenticate: Log in as the restricted user via the File Browser web interface or API to obtain a valid session token.
3. Upload or identify a target file: Upload a sensitive file (e.g., POST /api/resources/secret.pdf with Content-Type: application/pdf) or identify an existing file accessible to the account.
4. Confirm download is blocked: Attempt a direct download via GET /api/raw/secret.pdf — the server should respond with 202 Accepted (blocked), confirming the restriction is in place.
5. Create a public share: Send POST /api/share/secret.pdf as the authenticated user. The server responds with 200 OK and a share hash (e.g., qxfK3JMG).
6. Retrieve file via public endpoint: Without any authentication, send GET /api/public/dl/<hash> (e.g., GET /api/public/dl/qxfK3JMG). The server responds with 200 OK, Content-Type: application/pdf, and the full file content, bypassing the download restriction (Security Advisory).

• Network: Authenticated POST requests to /api/share/<filename> from users who have perm.download = false; subsequent unauthenticated GET requests to /api/public/dl/<hash> from external or unexpected IP addresses shortly after share creation.
• Logs: File Browser access logs showing a POST /api/share/ returning 200 followed by a GET /api/public/dl/<hash> returning 200 from a different IP or unauthenticated session; GET /api/raw/<filename> returning 202 Accepted (blocked) immediately before a share creation event for the same file.
• Application Behavior: Share links created by users who are configured with perm.download = false — this combination should not be possible in patched versions and indicates either a vulnerable version or policy misconfiguration (Security Advisory).

Upgrade File Browser to version 2.62.0 or later, which fixes the issue by requiring both Perm.Share and Perm.Download before allowing share creation in http/share.go (Fix Commit, v2.62.0 Release). As an interim workaround, administrators should revoke perm.share from any user who is also denied perm.download, ensuring that the two permissions are not granted independently. Additionally, review all existing public share links and revoke any created by users with download restrictions.

The vulnerability was reported by security researcher Ahmad-jarwan and remediated by File Browser maintainer hacdias. The advisory was published on March 17, 2026, and the fix was released the same day in v2.62.0. No significant broader media coverage or notable community commentary beyond the GitHub advisory has been identified (Github Advisory).