CVE-2026-32761 is a medium-severity (CVSS 6.5) CWE-284 vulnerability in https://github.com/filebrowser/filebrowser. No vendor fix is recorded yet; mitigation options are listed below.
File Browser has an Authorization Policy Bypass in its Public Share Download Flow
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-32761.
EPSS Exploitation Probability
EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.
How urgent is this, really
CVE-2026-32761 plotted by exploitation likelihood (EPSS) against impact (CVSS). The shaded corner — EPSS 50%+ and CVSS 7.0+ — is where this CVE doesn't sit, though severity or exploitability alone can still warrant action.
Where this sits among everything scored
Of 377,333 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Real counts from FIRST.org, not a sample — log-scaled since the landscape is heavily right-skewed.
Real-World Exposure
https://github.com/filebrowser/filebrowserReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.
Description
Summary
A permission enforcement flaw allows users without download privileges (download=false) to still expose and retrieve file content via public share links when they retain share privileges (share=true). This bypasses intended access control policy and enables unauthorized data exfiltration to unauthenticated users. Where download restrictions are used for data-loss prevention or role separation.
Details
The backend applies inconsistent authorization checks across download paths:
- Direct raw download correctly enforces
Perm.Download:- [raw.go](filebrowser/http/raw.go:82)
- Share creation only enforces
Perm.Share:- [share.go](filebrowser/http/share.go:21)
- Public share/download handlers serve shared content without verifying owner
Perm.Download:
As a result, a user who is blocked from direct downloads can create a share and obtain the same file via /api/public/dl/<hash>.
PoC
- Create a non-admin user with:
perm.share = trueperm.download = false
- Login as that user and upload a PDF file:
POST /api/resources/nodl_secret_<rand>.pdfwithContent-Type: application/pdf
- Verify direct raw download is denied:
GET /api/raw/nodl_secret_<rand>.pdf- Expected and observed:
202 Accepted(blocked)
- Create share for same file:
POST /api/share/nodl_secret_<rand>.pdf- Observed:
200, response includeshash(example:qxfK3JMG)
- Download publicly without authentication:
GET /api/public/dl/<hash>- Observed (vulnerable):
200,Content-Type: application/pdf, and PDF bytes are returned
Live evidence captured (March 1, 2026):
create user:201create file:200direct /api/raw:202 Acceptedcreate share:200public download /api/public/dl/mxK-ppZb:200public download content-type:application/pdfpublic download body length:327bytes
Impact
This is an access control / authorization policy bypass vulnerability.
- Who can exploit: Any authenticated user granted
share=truebut denieddownload. - Who is impacted: Operators and organizations relying on download restrictions to prevent data export.
- What can happen: Restricted users can still distribute and retrieve files publicly, including unauthenticated access through share URLs.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐹Go | https://github.com/filebrowser/filebrowser | all versions | No fix |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for https://github.com/filebrowser/filebrowser, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Remediation status
No patched version of https://github.com/filebrowser/filebrowser has shipped for CVE-2026-32761 yet. Where your build allows, override or pin the dependency away from the vulnerable range, and apply any maintainer-recommended mitigation.
Mitigate without a patch
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 Security's impact-aware SCA analyses which vulnerable code paths your application actually calls, so a match like CVE-2026-32761 can be triaged on real exposure rather than presence alone.
Tailored to CVE-2026-32761. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is CVE-2026-32761 in your dependencies?
O3 Security finds CVE-2026-32761 across Go dependencies, including transitive ones, and its impact-aware SCA ranks findings by whether your code actually calls the vulnerable path.