{"api_version":"1","generated_at":"2026-10-24T12:01:20+00:00","cve":"CVE-2026-57492","urls":{"html":"https://cve.report/CVE-2026-57492","api":"https://cve.report/api/cve/CVE-2026-57492.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-57492","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-57492"},"summary":{"title":"FileRise: Setup mode re-activates when users.txt becomes empty, allowing unauthenticated admin creation","description":"FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise treats an empty or missing users.txt file as a fresh installation even after setup previously completed. If storage loss, truncation, or another failure empties the user store, an unauthenticated remote caller can detect that setup mode reopened and create the next initial administrator account through the setup flow. The application lacked a durable setup-complete marker independent of the mutable user store. This issue is fixed in version 3.16.0.","state":"PUBLISHED","assigner":"GitHub_M","published_at":"2026-10-14 21:17:37","updated_at":"2026-10-15 16:18:17"},"problem_types":["CWE-306","CWE-306 CWE-306: Missing Authentication for Critical Function"],"metrics":[{"version":"3.1","source":"security-advisories@github.com","type":"Secondary","score":"7.4","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.4","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","data":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}}],"references":[{"url":"https://github.com/error311/FileRise/commit/f7114ca2a4e624238dda0d097a07ad6b05c11bb6","name":"https://github.com/error311/FileRise/commit/f7114ca2a4e624238dda0d097a07ad6b05c11bb6","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/error311/FileRise/releases/tag/v3.16.0","name":"https://github.com/error311/FileRise/releases/tag/v3.16.0","refsource":"security-advisories@github.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/error311/FileRise/security/advisories/GHSA-g555-3rg9-wrq8","name":"https://github.com/error311/FileRise/security/advisories/GHSA-g555-3rg9-wrq8","refsource":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-57492","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57492","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"error311","product":"FileRise","version":"affected < 3.16.0","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-57492","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-10-15T15:28:49.012069Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-10-15T15:29:11.267Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["exploit"],"url":"https://github.com/error311/FileRise/security/advisories/GHSA-g555-3rg9-wrq8"}],"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"FileRise","vendor":"error311","versions":[{"status":"affected","version":"< 3.16.0"}]}],"descriptions":[{"lang":"en","value":"FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise treats an empty or missing users.txt file as a fresh installation even after setup previously completed. If storage loss, truncation, or another failure empties the user store, an unauthenticated remote caller can detect that setup mode reopened and create the next initial administrator account through the setup flow. The application lacked a durable setup-complete marker independent of the mutable user store. This issue is fixed in version 3.16.0."}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-306","description":"CWE-306: Missing Authentication for Critical Function","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-14T20:21:15.070Z","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M"},"references":[{"name":"https://github.com/error311/FileRise/security/advisories/GHSA-g555-3rg9-wrq8","tags":["x_refsource_CONFIRM"],"url":"https://github.com/error311/FileRise/security/advisories/GHSA-g555-3rg9-wrq8"},{"name":"https://github.com/error311/FileRise/commit/f7114ca2a4e624238dda0d097a07ad6b05c11bb6","tags":["x_refsource_MISC"],"url":"https://github.com/error311/FileRise/commit/f7114ca2a4e624238dda0d097a07ad6b05c11bb6"},{"name":"https://github.com/error311/FileRise/releases/tag/v3.16.0","tags":["x_refsource_MISC"],"url":"https://github.com/error311/FileRise/releases/tag/v3.16.0"}],"source":{"advisory":"GHSA-g555-3rg9-wrq8","discovery":"UNKNOWN"},"title":"FileRise: Setup mode re-activates when users.txt becomes empty, allowing unauthenticated admin creation"}},"cveMetadata":{"assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","assignerShortName":"GitHub_M","cveId":"CVE-2026-57492","datePublished":"2026-10-14T20:21:15.070Z","dateReserved":"2026-06-24T14:53:40.111Z","dateUpdated":"2026-10-15T15:29:11.267Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-14 21:17:37","lastModifiedDate":"2026-10-15 16:18:17","problem_types":["CWE-306","CWE-306 CWE-306: Missing Authentication for Critical Function"],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":7.4,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-15T15:28:49.012069Z","id":"CVE-2026-57492","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"57492","Ordinal":"1","Title":"FileRise: Setup mode re-activates when users.txt becomes empty, ","CVE":"CVE-2026-57492","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"57492","Ordinal":"1","NoteData":"FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise treats an empty or missing users.txt file as a fresh installation even after setup previously completed. If storage loss, truncation, or another failure empties the user store, an unauthenticated remote caller can detect that setup mode reopened and create the next initial administrator account through the setup flow. The application lacked a durable setup-complete marker independent of the mutable user store. This issue is fixed in version 3.16.0.","Type":"Description","Title":"FileRise: Setup mode re-activates when users.txt becomes empty, "}]}}}