CVE-2026-23849 File Browser vulnerable to Username Enumeration via Timing Attack in /api/login
Unauthenticated attackers can enumerate valid usernames in File Browser by measuring response time differences during login attempts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23849?
CVE-2026-23849 is a medium-severity vulnerability in filebrowser, published on 19 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
File Browser provides a file managing interface within a specified directory and can be used to upload, delete, preview, rename, and edit files. Prior to version 2.55.0, the JSONAuth. Auth function contains a logic flaw that allows unauthenticated attackers to enumerate valid usernames by measuring the response time of the /api/login endpoint. The vulnerability exists due to a "short-circuit" evaluation in the authentication logic. When a username is not found in the database, the function returns immediately. However, if the username does exist, the code proceeds to verify the password using bcrypt (users.CheckPwd), which is a computationally expensive operation designed to be slow. This difference in execution path creates a measurable timing discrepancy. Version 2.55.0 contains a patch for the issue.
Which versions are affected by CVE-2026-23849?
6 open source packages ship an affected version, including github.com/filebrowser/filebrowser and github.com/filebrowser/filebrowser/v2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/filebrowser/filebrowser Go | All versions | None |
github.com/filebrowser/filebrowser Go | All versions to 1.11.0 | None |
github.com/filebrowser/filebrowser Go | All versions to 1.11.0 | None |
github.com/filebrowser/filebrowser/v2 Go | All versions | 2.55.0 |
github.com/filebrowser/filebrowser/v2 Go | All versions | 2.55.0 |
github.com/filebrowser/filebrowser/v2 Go | All versions | 2.55.0 |
Products include Filebrowser Filebrowser.
How do I fix CVE-2026-23849?
Upgrade to a fixed version.
Is CVE-2026-23849 being exploited?
There is no known exploitation of CVE-2026-23849 in the wild and no public exploit code.
Other vulnerabilities in filebrowser
- CVE-2026-32760 File Browser Self Registration Grants Any User Admin Access When Default Permissions Include Admin
- CVE-2026-29188 File Browser: TUS Delete Endpoint Bypasses Delete Permission Check
- CVE-2023-39612 Cross-site scripting in n/a
- CVE-2026-30934 FileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse)
- CVE-2021-46398 Cross-Site Request Forgery in Filebrowser
Sources
Also known as GHSA-43mm-m3h2-3prc, GO-2026-4344.