Is CVE-2026-104108 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104108 being exploited in the wild.

How severe is CVE-2026-104108?

High severity, with a CVSS score of 8.1, published 14 October 2026.

How is CVE-2026-104108 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-104108?

Check whether you run Filerise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104108: FileRise OIDC authentication bypass via mutable claims

CVE-2026-104108 · Severity: high · CVSS 8.1 · Published 2026-10-14

FileRise is a self-hosted web-based file manager. Prior to version 3.23.0, an attacker who can obtain forged or manipulated identity provider claims can bypass authentication and log in as an existing user, including the administrator account, by exploiting how FileRise maps mutable username and email claims to local accounts. This could allow unauthorized access to all files and administrative functions.

Technologies: Filerise. Vendors: Filerise.

Quick answers

Is CVE-2026-104108 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104108 being exploited in the wild.
How severe is CVE-2026-104108?: High severity, with a CVSS score of 8.1, published 14 October 2026.
Which products and versions are affected?: Filerise prior to 3.23.0.
Is there a fix for CVE-2026-104108?: Yes: fixed in 3.23.0. Until then: Before upgrading to 3.23.0, verify a working local administrator login and back up the users directory. On first OIDC login after upgrade, existing accounts will be prompted to confirm their local password to establish the immutable issuer-subject binding; new OIDC identities without local account collisions auto-provision normally. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-104108 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-104108?: Check whether you run Filerise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.23.0

Before upgrading to 3.23.0, verify a working local administrator login and back up the users directory. On first OIDC login after upgrade, existing accounts will be prompted to confirm their local password to establish the immutable issuer-subject binding; new OIDC identities without local account collisions auto-provision normally.

Technical details

FileRise maps authenticated OIDC identity claims to local accounts using mutable preferred_username or email claims without requiring email_verified validation, allowing claim collision attacks. An attacker with access to provider-issued claims (via provider compromise, misconfiguration, or provider-specific weaknesses) can craft colliding claims that match an existing local username to gain that account's privileges, including administrator access. The fix in 3.23.0 binds accounts to immutable issuer-and-subject identities and rejects unverified email claims for account naming.

Affected products

FileRise FileRise prior to 3.23.0

Timeline

2026-10-14: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.