CVE-2026-104108High· 8.1▾ TwilightFileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise maps an authenticated OIDC identity to a local account using mutable preferred_username or email claims and…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise maps an authenticated OIDC identity to a local account using mutable preferred_username or email claims and does not require email_verified for email-based naming. An attacker who can obtain provider-issued claims colliding with an existing local username can be logged in as that account, including the built-in administrator, even when automatic provisioning is disabled. Exploitability depends on the configured identity provider allowing the colliding claim. This issue is fixed in version 3.23.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-104105Medium· 6.4FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations
CVE-2022-28321Critical· 9.8The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins
CVE-2026-106460Medium· 6.8Backstage is an open framework for building developer portals
CVE-2026-105640Critical· 9.1Plane is an open-source project management tool
CVE-2026-101280High· 7.3A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2
CVE-2023-49105Critical· 9.8An issue was discovered in ownCloud owncloud/core before 10.13.1