Vulnerability Description
FileRise before version 3.28.0 contains a privilege escalation vulnerability that allows authenticated low-privilege attackers to gain unauthorized read and write access by exploiting improper session isolation between the WebDAV interface and the web application session context. Attackers can combine valid Basic-Auth credentials with an active admin PHPSESSID cookie to bypass authorization boundaries, as the WebDAV layer incorrectly inherits elevated privileges from an ambient web session rather than enforcing independent stateless authentication per RFC 4918.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/error311/FileRise/releases/tag/v3.28.0
- https://www.vulncheck.com/advisories/filerise-privilege-escalation-via-webdav-se
FAQ
What is CVE-2026-92616?
CVE-2026-92616 is a vulnerability with a CVSS score of 6.8 (MEDIUM). FileRise before version 3.28.0 contains a privilege escalation vulnerability that allows authenticated low-privilege attackers to gain unauthorized read and write access by exploiting improper session...
How severe is CVE-2026-92616?
CVE-2026-92616 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-92616?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.