# CVE-2026-57493: FileRise privilege escalation in remember-me token handling

Source: https://junglewise.ai/threats/cve-2026-57493-filerise-is-a-self-hosted-web-based-file-manager-with-multi-file  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-57493 · Severity: medium · CVSS 6.8 · Published 2026-10-14

FileRise is a web-based file manager that allows administrators to manage files remotely. Prior to version 3.16.0, the application stores administrator privileges in remember-me login tokens and fails to update these privileges when a user is demoted, allowing a demoted administrator to retain admin access by using an old token. An attacker with access to a pre-demotion token can use it to regain administrative control over the file manager.

Technologies: [Filerise](https://junglewise.ai/threats/technologies/filerise-filerise). Vendors: [Filerise](https://junglewise.ai/threats/vendors/filerise).

## Quick answers

**Is CVE-2026-57493 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57493 being exploited in the wild.

**How severe is CVE-2026-57493?** Medium severity, with a CVSS score of 6.8, published 14 October 2026.

**Which products and versions are affected?** Filerise before 3.16.0.

**Is there a fix for CVE-2026-57493?** Yes: fixed in 3.16.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57493 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-57493?** Check whether you run Filerise at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.16.0

## Technical details

FileRise stores the isAdmin flag within remember-me tokens and restores this stale value during automatic login rather than checking the current user role from users.txt. A user demoted from administrator status can retain administrative access using a token issued before demotion, and token rotation propagates the stale privilege into replacement tokens. Exploitation requires possession of a remember-me token from before the user's demotion; the fix in 3.16.0 resolves admin status from the current user record instead of trusting cached role data.

## Affected products

- FileRise FileRise before 3.16.0

## Timeline

- 2026-10-14: advisory
- 2026-06-16: patched

## References

- [https://github.com/error311/FileRise/commit/f7114ca2a4e624238dda0d097a07ad6b05c11bb6](https://github.com/error311/FileRise/commit/f7114ca2a4e624238dda0d097a07ad6b05c11bb6)
- [https://github.com/error311/FileRise/releases/tag/v3.16.0](https://github.com/error311/FileRise/releases/tag/v3.16.0)

## Related threats

- [FileRise weak default encryption key in pristine installations](https://junglewise.ai/threats/cve-2026-77427-filerise-is-a-self-hosted-web-based-file-manager-with-multi-file)
- [FileRise OIDC authentication bypass via mutable claims](https://junglewise.ai/threats/cve-2026-104108-filerise-is-a-self-hosted-web-based-file-manager-with-multi-file)
- [FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to…](https://junglewise.ai/threats/cve-2025-66403-filerise-is-a-self-hosted-web-based-file-manager-with-multi-file)
- [FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In version…](https://junglewise.ai/threats/cve-2025-62510-filerise-is-a-self-hosted-web-based-file-manager-with-multi-file)
- [FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to…](https://junglewise.ai/threats/cve-2025-62509-filerise-is-a-self-hosted-web-based-file-manager-with-multi-file)