CVE-2026-3266 Improper access control vulnerability has been discovered in OpenText™ Filr.
Unauthenticated attackers can bypass authentication to obtain XSRF tokens and execute RPC calls in OpenText Filr.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-3266?
CVE-2026-3266 is a high-severity missing authorization vulnerability in OpenText™ Filr, published on 3 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Missing Authorization vulnerability in OpenText™ Filr allows Authentication Bypass. The vulnerability could allow unauthenticated users to get XSRF token and do RPC with carefully crafted programs.
This issue affects Filr: through 25.1.2.
Weakness: CWE-862
Which versions are affected by CVE-2026-3266?
It affects 1 product.
Products include Opentext Filr.
How do I fix CVE-2026-3266?
No fix has been published for CVE-2026-3266 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-3266 being exploited?
There is no known exploitation of CVE-2026-3266 in the wild and no public exploit code.
Other vulnerabilities in OpenText™ Filr
Sources
Also known as GHSA-7qvm-mwp7-fqc3.