CVE-2026-44460: error311 FileRise TOTP bypass in totp_setup.php

CVE-2026-44460 · Severity: high · CVSS 7.4 · Published 2026-05-27

FileRise is a self-hosted web-based file manager used for managing and sharing files. A security flaw in its login process allows an attacker who already knows a user's password to bypass two-factor authentication (2FA). By accessing a specific setup page during the login process, the attacker can retrieve the victim's secret 2FA key, allowing them to generate valid login codes and gain full access to the account and its files without needing the victim's physical device.

Technologies: Error311 FileRise. Vendors: Error311.

Quick answers

Is CVE-2026-44460 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44460 being exploited in the wild.
How severe is CVE-2026-44460?
High severity, with a CVSS score of 7.4, published 27 May 2026.
Which products and versions are affected?
Error311 FileRise < 3.12.0.
Is there a fix for CVE-2026-44460?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-44460 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-44460?
Check whether you run Error311 FileRise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A logic flaw exists in the `/api/totp_setup.php` endpoint where it incorrectly grants access to sessions in the `pending_login_user` state (users who have provided a valid password but not yet a TOTP code). When accessed, the endpoint decrypts and returns the user's existing TOTP secret within a QR code payload instead of generating a new one or denying the request. An attacker with knowledge of a user's password can programmatically fetch this QR code, extract the TOTP secret, and generate a valid one-time password to complete the authentication via `/api/totp_verify.php`. This effectively nullifies the security benefits of 2FA. The issue is fixed in version 3.12.0 by requiring a fully authenticated session for TOTP setup and preventing the re-emission of existing secrets.

Affected products

  • error311 FileRise < 3.12.0

Timeline

  • 2026-05-07: advisory: Vendor advisory published on GitHub
  • 2026-05-27: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.