A critical privilege escalation flaw in filebrowser through version 2.63.16 lets unauthenticated attackers register their own accounts that inherit the server root scope with full file permissions.
What Is It
CVE-2026-72839 is an incorrect privilege assignment vulnerability (CWE-266) in filebrowser, the self-hosted web file manager. When self-signup is enabled and the CreateUserDir setting is left at its default, the server fails to properly restrict the scope and permissions assigned to newly registered accounts.
Instead of being confined to a per-user directory, accounts created through the public signup flow inherit the server root scope, along with create, modify, delete, rename, share, and download permissions.
Why It Matters
Exploitation depends on one configuration precondition; the target instance must have self-signup enabled with the default CreateUserDir setting. Against an instance in that state, the attack needs no credentials, no user interaction, and no technical sophistication: an attacker only needs network access and the public registration form. Registration is the exploit.
VulnCheck assigns a CVSS 3.1 base score of 9.8 (Critical): AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, with a CVSS 4.0 score of 9.3 (Critical). Confidentiality, integrity, and availability impacts are all rated High, reflecting that a registered attacker can read, alter, or destroy every file the filebrowser process can reach, and share those files outward.
What's Vulnerable
- Product: filebrowser (
pkg:golang/github.com/filebrowser/filebrowser/v2) - Affected versions: all versions through 2.63.16
- Required condition: self-signup enabled with the default
CreateUserDirsetting
Instances that keep registration closed are not exposed by this specific path. No CPE data has been published yet, and the NVD record remains in Received status as of its 2026-08-13 publication.
Patch Status
The supplied source material does not specify a fixed release version or remediation deadline. Operators should consult the upstream GitHub security advisory (GHSA-6759-996p-gpj6) for fix availability. In the interim, the exploit precondition is under administrator control: disabling self-signup removes the unauthenticated registration path entirely.
This CVE does not appear in the CISA Known Exploited Vulnerabilities catalog in the supplied data; there is no confirmation of active exploitation, and no federal remediation due date applies.
Sources
- NVD, CVE-2026-72839: https://nvd.nist.gov/vuln/detail/CVE-2026-72839
- filebrowser GitHub Security Advisory (GHSA-6759-996p-gpj6): https://github.com/filebrowser/filebrowser/security/advisories/GHSA-6759-996p-gpj6
- VulnCheck Advisory; filebrowser privilege escalation via signup: https://www.vulncheck.com/advisories/filebrowser-through-privilege-escalation-via-signup