{"id":"CVE-2026-57493","aliases":["EUVD-2026-101666","GHSA-r55g-3hcc-6jx7"],"status":"published","title":"FileRise: Remember-me auto-login uses stale admin role from token instead of current role","description":"FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise stores the isAdmin flag in remember-me tokens and restores that stale value during automatic login instead of resolving the account's current role from users.txt. A user who was issued a token while an administrator can retain administrator access after demotion, and token rotation copies the stale privilege into each replacement token. Exploitation requires possession of the pre-demotion remember-me token. This issue is fixed in version 3.16.0.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.003,"percentile":0.23055,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-613"],"published":"2026-10-14T20:22:06Z","modified":"2026-10-28T02:30:58Z","products":[{"vendor":"error311","product":"filerise"}],"references":[{"url":"https://github.com/error311/FileRise/security/advisories/GHSA-r55g-3hcc-6jx7","tags":["x_refsource_CONFIRM","exploit","advisory"]},{"url":"https://github.com/error311/FileRise/commit/f7114ca2a4e624238dda0d097a07ad6b05c11bb6","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/error311/FileRise/releases/tag/v3.16.0","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57493.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57493","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-57493","title":"FileRise: Remember-me auto-login uses stale admin role from token instead of current role","description":"FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise stores the isAdmin flag in remember-me tokens and restores that stale value during automatic login instead of resolving the account's current role from users.txt. A user who was issued a token while an administrator can retain administrator access after demotion, and token rotation copies the stale privilege into each replacement token. Exploitation requires possession of the pre-demotion remember-me token. This issue is fixed in version 3.16.0.","status":"published","published":"2026-10-14T20:22:06.735Z","modified":"2026-10-20T02:08:08.01Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T13:43:44.898272Z"}],"euvd":[{"id":"EUVD-2026-101666","description":"FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise stores the isAdmin flag in remember-me tokens and restores that stale value during automatic login instead of resolving the account's current role from users.txt. A user who was issued a token while an administrator can retain administrator access after demotion, and token rotation copies the stale privilege into each replacement token. Exploitation requires possession of the pre-demotion remember-me token. This issue is fixed in version 3.16.0.","status":"published","published":"2026-10-14T20:22:06Z","modified":"2026-10-20T02:08:08Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T16:59:44.419021Z"}],"nvd":[{"id":"CVE-2026-57493","description":"FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise stores the isAdmin flag in remember-me tokens and restores that stale value during automatic login instead of resolving the account's current role from users.txt. A user who was issued a token while an administrator can retain administrator access after demotion, and token rotation copies the stale privilege into each replacement token. Exploitation requires possession of the pre-demotion remember-me token. This issue is fixed in version 3.16.0.","status":"published","published":"2026-10-14T21:17:37.8Z","modified":"2026-10-20T03:17:15.97Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T14:12:59.328869Z"}],"osv":[{"id":"CVE-2026-57493","title":"FileRise: Remember-me auto-login uses stale admin role from token instead of current role","description":"FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise stores the isAdmin flag in remember-me tokens and restores that stale value during automatic login instead of resolving the account's current role from users.txt. A user who was issued a token while an administrator can retain administrator access after demotion, and token rotation copies the stale privilege into each replacement token. Exploitation requires possession of the pre-demotion remember-me token. This issue is fixed in version 3.16.0.","status":"published","published":"2026-10-14T20:22:06.735Z","modified":"2026-10-28T02:30:58.73693442Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T15:45:12.016252Z"}]}}