FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise stores the isAdmin flag in remember-me tokens and restores that stale value during automatic login instead of resolving the account's current role from users.txt. A user who was issued a token while an administrator can retain administrator access after demotion, and token rotation copies the stale privilege into each replacement token.
Exploitation requires possession of the pre-demotion remember-me token. This issue is fixed in version 3.16.0.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
High
Difficult to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
References 3
https://github.com/error311/FileRise/commit/f7114ca2a4e624238dda0d097a07ad6b05c…
security-advisories@github.com
https://github.com/error311/FileRise/releases/tag/v3.16.0
security-advisories@github.com
https://github.com/error311/FileRise/security/advisories/GHSA-r55g-3hcc-6jx7
security-advisories@github.com