CVE-2026-103988 error311 CVE debrief

Who should care

FileRise administrators, users with write access to folders, security teams responsible for monitoring and protecting file management systems, and operators managing FileRise instances should assess exposure and prioritize updating to version 3.23.0 or later. These stakeholders should review and restrict write access to folders for non-administrator users and monitor for suspicious activity on FileRise instances.

Why it matters

CVE-2026-103988 is a medium-severity vulnerability in FileRise that allows authenticated, non-administrator users to move folders without proper authorization. This could lead to unauthorized changes to folder ownership and access control lists. FileRise administrators and users with write access to folders should assess exposure and prioritize updating to version 3.23.0 or later.

• Potential unauthorized folder movement by non-administrator users
• Possible changes to ownership and ACL records
• Limited information about potential exploits or attacks

Technical summary

The FileRise renameFolder API endpoint does not properly authorize changes to the destination parent folder. An authenticated, non-administrator user with a valid CSRF token can move a folder to a different parent folder, potentially changing the ownership and ACL records. This vulnerability affects FileRise versions prior to 3.23.0 and allows users to move folders without proper authorization, which could lead to unauthorized changes to folder ownership and access control lists. The destination folder must be unused, and existing files cannot be overwritten. The vulnerability is fixed in version 3.23.0.

Defensive priority

Medium priority for FileRise administrators and users with write access to folders

Recommended defensive actions

• FileRise administrators should update to version 3.23.0 or later
• Review and restrict write access to folders for non-administrator users
• Monitor for suspicious activity on FileRise instances
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details about the vulnerability, its impact, and the fixed version. However, there is limited information about potential exploits or attacks. To verify, defenders should check the official advisory and review system logs for suspicious activity related to FileRise instances. The vulnerability affects FileRise versions prior to 3.23.0, and administrators should update to the latest version. Evidence from the CVE record and source item suggests that the vulnerability is medium-severity and allows

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.