CVE-2026-72836 FileBrowser before 2.63.19 Case Sensitivity Authentication Bypass
Attackers can bypass home directory ownership checks on case-insensitive filesystems to read, modify, or delete other users' files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-72836?
CVE-2026-72836 is a critical authentication bypass vulnerability in filebrowser, published on 14 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and CreateUserDir are enabled and FileBrowser's root is on a case-insensitive filesystem (confirmed on Windows/NTFS), two self-registered usernames that differ only in letter case (e.g., CaseVictim and casevictim) are stored as distinct accounts but resolve to the same physical home directory, because the scope-ownership check compares the persisted scope as an exact case-sensitive string. A second registrant can therefore read, overwrite, and delete another account's files through authenticated HTTP endpoints, without needing an existing account or victim interaction.
Weakness: CWE-178
Which versions are affected by CVE-2026-72836?
How do I fix CVE-2026-72836?
No fix has been published for CVE-2026-72836 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-72836 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-72836 exists.
Sources
Also known as GHSA-576v-w77m-gr84, GHSA-f37p-wpgx-m9mr.