CVE-2026-57492 error311 CVE debrief

Who should care

Defenders responsible for FileRise installations should assess exposure and verify versions to prevent potential unauthenticated admin creation. They should review setup configurations and monitor for potential attacks. Security teams and vulnerability management teams should also be aware of this vulnerability and take necessary actions to protect their systems.

Why it matters

CVE-2026-57492 allows unauthenticated admin creation in FileRise when setup mode re-activates due to an empty users.txt file. Defenders should verify versions, review setup configurations, and monitor for potential attacks.

• Verify FileRise version to ensure 3.16.0 or later is deployed
• Review setup mode configuration to prevent re-activation
• Monitor for potential unauthenticated admin creation attempts

Technical summary

FileRise treats an empty or missing users.txt file as a fresh installation, even after setup previously completed. This allows an unauthenticated remote caller to detect that setup mode reopened and create the next initial administrator account through the setup flow. The application lacked a durable setup-complete marker independent of the mutable user store. This issue is fixed in version 3.16.0, which addresses the vulnerability by ensuring that setup mode is not re-activated when the users.txt file is empty or missing.

Defensive priority

Defenders should prioritize verifying FileRise versions and ensuring proper setup mode configuration.

Recommended defensive actions

• Verify FileRise version and ensure it is 3.16.0 or later
• Review setup mode configuration to prevent re-activation
• Monitor for potential unauthenticated admin creation attempts
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and fixed version. The vulnerability allows an attacker to create an admin account without authentication if the users.txt file is empty or missing. The issue is fixed in version 3.16.0. Defenders should verify the FileRise version and review setup configurations to prevent potential attacks. The empty or missing users.txt file is treated as a fresh installation, allowing an unauthenticated remote caller to detect that

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.