CVE-2026-57489 error311 CVE debrief

Who should care

Defenders responsible for FileRise deployments, particularly those with AUTH_BYPASS enabled, should assess exposure and prioritize upgrading to version 3.16.0. This includes operators, administrators, and security teams managing FileRise installations. They should review configurations, verify exposure, and apply mitigations as necessary.

Why it matters

CVE-2026-57489 is a high-severity vulnerability in FileRise that allows for full authentication bypass when AUTH_BYPASS is enabled. Defenders should prioritize verifying exposure and upgrading to version 3.16.0 to mitigate the vulnerability.

• An unauthenticated attacker can obtain a session for any asserted account, including administrator accounts, without a password or MFA.
• The vulnerability allows for full authentication bypass in FileRise deployments with AUTH_BYPASS enabled.
• Defenders need to verify exposure of FileRise deployments and upgrade to version 3.16.0 to mitigate the vulnerability.
• The issue requires verification of proxy-header authentication configurations and untrusted paths to the backend.

Technical summary

FileRise, a self-hosted web-based file manager, has a vulnerability in versions prior to 3.16.0. When AUTH_BYPASS is enabled, the application trusts the configured reverse-proxy identity header without verifying that the request originated from FR_TRUSTED_PROXIES. This allows an unauthenticated attacker to supply X-Remote-User and obtain a session for the asserted account, including an administrator account, without a password or MFA. The flaw is limited to deployments that enable proxy-header authentication and expose an untrusted path to the backend.

Defensive priority

Defenders should prioritize verifying exposure of FileRise deployments with AUTH_BYPASS enabled and upgrading to version 3.16.0.

Recommended defensive actions

• Verify if FileRise deployments with AUTH_BYPASS enabled trust the configured reverse-proxy identity header without verifying that the request originated from FR_TRUSTED_PROXIES.
• Upgrade FileRise to version 3.16.0 or later.
• Review and update configurations for proxy-header authentication and untrusted paths to the backend.
• Monitor for potential authentication bypass attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the authentication bypass vulnerability in FileRise. The issue is fixed in version 3.16.0. There is no evidence of public exploitation. Defenders should verify exposure of FileRise deployments with AUTH_BYPASS enabled and review configurations for proxy-header authentication and untrusted paths to the backend.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.