CVE-2026-104106 error311 CVE debrief

Who should care

Defenders responsible for FileRise instances, particularly those with multi-user environments or sensitive data, should assess exposure and prioritize remediation. They should review authentication and authorization mechanisms, monitor for suspicious activity, and verify the vulnerability's impact on their systems. Security teams and vulnerability management teams should also be aware of the potential risks and take necessary actions to mitigate them.

Why it matters

CVE-2026-104106 is a medium-severity vulnerability in FileRise that allows an attacker to disable 2FA or enroll a new TOTP secret without proper reauthentication, potentially increasing the attack surface.

• An attacker controlling an existing authenticated session can disable an existing second factor or enroll one after the account has no configured secret.
• Defenders need to verify and upgrade to version 3.23.0 or later to prevent potential attacks.
• The vulnerability allows for potential lateral movement and increased attack surface.

Technical summary

FileRise, a self-hosted web-based file manager, has a vulnerability in its 2FA disable and TOTP enrollment process. Prior to version 3.23.0, an authenticated session with a valid CSRF token can disable TOTP without recent full reauthentication or begin enrollment when the account currently has no TOTP secret. This issue allows an attacker controlling an existing authenticated session to disable an existing second factor or enroll one after the account has no configured secret. The vulnerability is fixed in version 3.23.0, and defenders should prioritize verifying and upgrading to prevent potential attacks.

Defensive priority

Defenders should prioritize verifying and upgrading to version 3.23.0 or later, and review authentication and authorization mechanisms.

Recommended defensive actions

• Verify and upgrade to version 3.23.0 or later
• Review authentication and authorization mechanisms
• Monitor for suspicious activity
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and fixed version. The vulnerability allows for potential lateral movement and increased attack surface. Defenders should verify the vulnerability's impact on their systems, review authentication and authorization mechanisms, and monitor for suspicious activity. The CVE Program record and NIST NVD detail page offer additional information on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.