CVE-2026-32760

The registration handling procedure (signupHandler) copies all default system settings to the newly created account without any server-side verification that would remove the administrator flag from accounts created through the public endpoint. There is a missing explicit reset of the user.Perm.Admin = false field after applying the default configuration. If an administrator — intentionally or by mistake — sets defaults.perm.admin = true and simultaneously enables the signup feature, every account created through the public registration form automatically receives administrator privileges. An attacker does not need to possess any existing credentials or perform any additional steps.

An attacker gains full control over the File Browser application, including access to all files, the ability to manage other users' accounts, and modification of server settings. As a result, it is possible to read, delete, or overwrite any files stored in the managed directory.

Update File Browser to version 2.62.0, in which the issue has been resolved. Until the update, immediately disable the self-registration option (signup = false) or ensure that the default user permissions do not include the perm.admin = true flag.

File Browser in versions 2.61.2 and earlier, with configuration having self-registration enabled (signup = true) and default setting perm.admin = true