CWE-863

{
  "affected": [],
  "aliases": [
    "CVE-2024-49208"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-22T17:15:04Z",
    "severity": "MODERATE"
  },
  "details": "Archer Platform 2024.03 before version 2024.08 is affected by an authorization bypass vulnerability related to supporting application files. A remote unprivileged attacker could potentially exploit this vulnerability to elevate their privileges and delete system icons.",
  "id": "GHSA-j8vf-qmcj-wv9f",
  "modified": "2024-10-22T18:32:12Z",
  "published": "2024-10-22T18:32:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49208"
    },
    {
      "type": "WEB",
      "url": "https://www.archerirm.community/t5/platform-announcements/archer-update-for-multiple-vulnerabilities/ta-p/747545"
    },
    {
      "type": "WEB",
      "url": "https://www.archerirm.community/t5/platform-announcements/tkb-p/product-advisories-tkb"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-29757"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-19T06:15:23Z",
    "severity": "CRITICAL"
  },
  "details": "An incorrect authorisation check in the the\u00a0\u0027plant transfer\u0027 function of the Growatt cloud service allowed a malicous attacker with a valid account to transfer any plant into his/her account.",
  "id": "GHSA-j8w3-hxm2-cw7f",
  "modified": "2025-07-19T06:30:57Z",
  "published": "2025-07-19T06:30:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29757"
    },
    {
      "type": "WEB",
      "url": "https://csirt.divd.nl/CVE-2025-29757"
    },
    {
      "type": "WEB",
      "url": "https://csirt.divd.nl/DIVD-2025-00011"
    },
    {
      "type": "WEB",
      "url": "https://oss.growatt.com"
    },
    {
      "type": "WEB",
      "url": "https://server.growatt.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:C/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-6150"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-10T21:15:10Z",
    "severity": "MODERATE"
  },
  "details": "A non-admin user can cause short-term disruption in Target VM availability\u00a0in\u00a0Citrix Provisioning",
  "id": "GHSA-j94j-pqhq-qr6h",
  "modified": "2025-07-25T18:30:33Z",
  "published": "2024-07-10T21:30:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6150"
    },
    {
      "type": "WEB",
      "url": "https://support.citrix.com/article/CTX678025"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-0085"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-03-10T21:15:00Z",
    "severity": "MODERATE"
  },
  "details": "In setBluetoothTethering of PanService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege to activate tethering with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-134487438",
  "id": "GHSA-j97v-vvwp-6wx4",
  "modified": "2022-05-24T17:10:42Z",
  "published": "2022-05-24T17:10:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-0085"
    },
    {
      "type": "WEB",
      "url": "https://source.android.com/security/bulletin/pixel/2020-03-01"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-15513"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-14T07:16:14Z",
    "severity": "MODERATE"
  },
  "details": "The Float Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to improper error handling in the verifyFloatResponse() function in all versions up to, and including, 1.1.9. This makes it possible for unauthenticated attackers to mark any WooCommerce order as failed.",
  "id": "GHSA-j98h-2c2j-4x2p",
  "modified": "2026-04-08T21:33:10Z",
  "published": "2026-01-14T09:31:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15513"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/float-gateway/tags/1.1.9/index.php#L477"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3444078%40float-gateway\u0026new=3444078%40float-gateway\u0026sfp_email=\u0026sfph_mail="
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b2c7fb39-d128-4285-8bc3-1e192e1e1196?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-38789"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-01-19T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "Allwinner R818 SoC Android Q SDK V1.0 is affected by an incorrect access control vulnerability that does not check the caller\u0027s permission, in which a third-party app could change system settings.",
  "id": "GHSA-j997-wphj-qrj9",
  "modified": "2022-07-13T00:01:35Z",
  "published": "2022-01-20T00:00:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38789"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pokerfacett/MY_CVE_CREDIT/blob/master/Allwinner%20R818%20SoC%EF%BC%9Aaw_display%20service%20has%20EoP%20Vulnerability.md"
    },
    {
      "type": "WEB",
      "url": "https://vul.wangan.com/a/CNVD-2021-46927"
    },
    {
      "type": "WEB",
      "url": "https://www.allwinnertech.com/index.php?c=product\u0026a=index\u0026id=92"
    },
    {
      "type": "WEB",
      "url": "https://www.cnvd.org.cn/flaw/show/CNVD-2021-46927"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-3044"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-693",
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-09-26T16:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Inappropriate implementation in Site Isolation in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.",
  "id": "GHSA-j9cg-v2v5-9p35",
  "modified": "2025-05-22T15:34:42Z",
  "published": "2022-09-27T00:00:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3044"
    },
    {
      "type": "WEB",
      "url": "https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html"
    },
    {
      "type": "WEB",
      "url": "https://crbug.com/1051198"
    },
    {
      "type": "WEB",
      "url": "https://issues.chromium.org/issues/40051481"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202209-23"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@budibase/server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "3.38.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-269",
      "CWE-862",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-24T21:12:40Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\nBudibase `3.39.19` (commit `03fbabae4`) is affected by a privilege-escalation / missing-authorization flaw in the public role-assignment API. An **app-scoped builder** (a user who builds only specific apps \u2014 `user.builder.apps = [appA]`, not a global builder or admin) can grant **themselves builder access to ANY other app in the tenant**, or assign themselves/any user an arbitrary data-plane role (e.g. `ADMIN`) in any app, by calling `POST /api/public/v1/roles/assign`. The endpoint only authorizes the two *global* flags (`admin`, `builder`); the per-app `appBuilder` and `role:{appId,roleId}` grant vectors are passed to the backend **without any authorization check that the caller controls the target app**. Reproduced in a local authorized lab using the verbatim authorization-gate and SDK logic.\n\nThis is an incomplete fix of the role-assignment hardening in commit `d63d1d9054` (\"Inline public user global role validation\"), which only ever validated the global flags.\n\n### Details\n\nThe issue is caused by authorization being implemented as a **flag-level allowlist** (`admin`/`builder`) instead of validating the *scope* the caller is granting.\n\nRelevant code paths:\n\n- `packages/server/src/api/controllers/public/globalRoleValidation.ts` \u2014 `validateGlobalRoleUpdate(ctx, roleUpdate)` only checks `roleUpdate.admin` (requires `isAdmin`) and `roleUpdate.builder` (requires `isGlobalBuilder`). The `GlobalRoleUpdate` interface declares only `{ builder?, admin? }`; `appBuilder` and `role` are not referenced.\n- `packages/server/src/api/controllers/public/roles.ts` \u2014 `assign()` does `const { userIds, ...assignmentProps } = ctx.request.body; validateGlobalRoleUpdate(ctx, assignmentProps); await sdk.publicApi.roles.assign(userIds, assignmentProps)`. The `appBuilder`/`role` props pass through unvalidated.\n- `packages/pro/src/sdk/publicApi/roles.ts` \u2014 `assign()`: for `opts.appBuilder` it sets `user.builder = { apps: existing.concat([getProdWorkspaceID(opts.appBuilder.appId)]) }`; for `opts.role` it sets `user.roles[getProdWorkspaceID(opts.role.appId)] = opts.role.roleId`. No check that the caller builds the target app, and `userIds` is an arbitrary list (`bulkGet`). The only gate is the `isExpandedPublicApiEnabled()` license check.\n- `packages/server/src/api/routes/public/index.ts` \u2014 `applyAdminRoutes(roleEndpoints)` attaches **only** `middleware.builderOrAdmin` (no `publicApi`, no `authorized(PermissionType.USER, \u2026)`).\n- `packages/backend-core/src/middleware/builderOrAdmin.ts` \u2014 with a `workspaceId` present, it only requires `isBuilder(ctx.user, workspaceId)`. The attacker sets `x-budibase-app-id` to **their own** app (appA), so the gate passes.\n- `packages/backend-core/src/middleware/builderOnly.ts` \u2014 on the worker, `POST /api/global/self/api_key` only requires `hasBuilderPermissions(ctx.user)`, which is true for app-scoped builders, so the attacker can self-issue a public API key.\n- `packages/shared-core/src/sdk/documents/users.ts` \u2014 `isGlobalBuilder` is false for app-scoped builders (so the global `builder` flag is correctly blocked), while `isBuilder(user, appA)` and `hasBuilderPermissions(user)` are true.\n\nAttack flow:\n\n1. Attacker is an app-scoped builder of `appA` only (no global builder/admin).\n2. `POST /api/global/self/api_key` (worker) \u2014 passes `builderOnly` via `hasBuilderPermissions` \u2192 attacker obtains a public API key.\n3. `POST /api/public/v1/roles/assign` with header `x-budibase-app-id: \u003cappA prod id\u003e` and body `{\"userIds\":[\"\u003cself\u003e\"],\"appBuilder\":{\"appId\":\"\u003cappB\u003e\"}}` \u2014 `builderOrAdmin` passes (`isBuilder(user, appA)`), `validateGlobalRoleUpdate` ignores `appBuilder`, the SDK pushes `appB` into `user.builder.apps`.\n4. Attacker is now a builder of `appB` (and, via the `role` vector, can set any data-role such as `ADMIN` in any app).\n\nSecurity boundary crossed:\n\n- **Before:** builder of `appA` only.\n- **After:** builder of `appB` (and any other app) \u2192 read/modify all rows, read datasource configs and exfiltrate stored datasource credentials, edit automations (including the `bash`/`executeScript`/`executeQuery` steps); plus arbitrary data-role assignment in any app.\n- **Why disallowed:** the per-app builder model is meant to isolate builders to their assigned apps; a builder of one app must not gain authority over apps they were never granted.\n\n### PoC\n\nEnvironment:\n\n- Budibase version: `3.39.19`, commit `03fbabae4`\n- Deployment: Business/Enterprise license required (`isExpandedPublicApiEnabled`)\n- Attacker role: app-scoped builder (`user.builder.apps=[appA]`), not global builder/admin\n- Mock services: none needed for the unit-level proof; HTTP PoC script provided for a licensed lab\n\nSteps (unit-level proof, no license needed \u2014 verbatim auth-gate + SDK logic):\n\n1. Run the verification harness:\n\n```bash\ncd D:/CVE-Hunting/budibase-audit-output/lab\nnode harness/verify-privesc-authz.cjs\n```\n\n2. Observed result (evidence: `evidence/lab-privesc-authz.log`):\n\n```text\n[PASS-VALIDATION] appBuilder:{appId:APP_B}          -\u003e NOT rejected\n[PASS-VALIDATION] role:{appId:APP_B, roleId:\u0027ADMIN\u0027}-\u003e NOT rejected\n[BLOCKED 403]      builder:true (global)            -\u003e Only global builders or admins ...\n[BLOCKED 403]      admin:true (global)              -\u003e Only global admins ...\nafter : builder={\"apps\":[\"app_A...\",\"app_B...\"]} roles={\"app_B...\":\"ADMIN\"}\nisBuilder(attacker, APP_B) now = true   \u003c-- escalated to builder of APP_B\n```\n\nSteps (HTTP PoC for a licensed lab \u2014 `poc/privesc-roles-assign.sh`):\n\n```bash\n# 1) self-issue API key\ncurl -X POST http://localhost:10000/api/global/self/api_key -H \"Cookie: \u003cattacker session\u003e\" -d \u0027{}\u0027\n# 2) escalate: grant self builder of appB\ncurl -X POST http://localhost:10000/api/public/v1/roles/assign \\\n  -H \"x-budibase-api-key: \u003cKEY\u003e\" -H \"x-budibase-app-id: \u003cappA prod id\u003e\" \\\n  -H \"content-type: application/json\" \\\n  -d \u0027{\"userIds\":[\"\u003cself global id\u003e\"],\"appBuilder\":{\"appId\":\"\u003cappB\u003e\"}}\u0027\n```\n\n3. Expected result:\n\n```text\nThe request should be rejected (403) \u2014 an app-scoped builder must not be able to grant\nitself builder/role access to an app it does not control. Instead it returns 200 and the\ngrant is applied.\n```\n\nEvidence files:\n\n- `evidence/lab-privesc-authz.log`\n- `poc/verify-privesc-authz.cjs`, `poc/privesc-roles-assign.sh`\n\n**Runtime limitation:** full HTTP end-to-end requires a Business/Enterprise license (`isExpandedPublicApiEnabled`); no license was cracked. The authorization defect is proven at unit level with the verbatim validation + SDK logic, and the route\u2192validation\u2192SDK call chain was independently verified by source review.\n\n### Source PoC\n\n[Budibase-GHSA-Reports.zip](https://github.com/user-attachments/files/29161435/Budibase-GHSA-Reports.zip)\n\n### Impact\n\nAn attacker holding an **app-scoped builder** role on a single app in a licensed (Business/Enterprise) tenant can:\n\n* escalate to builder of **every other app** in the tenant (cross-app/workspace isolation bypass);\n* read and modify all rows in those apps;\n* read those apps\u0027 datasource configurations and **exfiltrate stored datasource credentials**;\n* edit automations in those apps, including server-side execution steps;\n* assign arbitrary data-plane roles (e.g. `ADMIN`) in any app to any user, including themselves.\n\nIt does **not** grant the global `admin`/`builder` flags (those are validated), so it is not a direct global-admin takeover; but cross-app builder is effectively a tenant-wide app/data-plane compromise. No real secrets were accessed during testing; the lab used canary-only data.",
  "id": "GHSA-j9fc-w3mr-x6mv",
  "modified": "2026-07-24T21:12:40Z",
  "published": "2026-07-24T21:12:40Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/security/advisories/GHSA-j9fc-w3mr-x6mv"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Budibase/budibase"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Budibase/budibase/releases/tag/3.40.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": " Budibase: Privilege escalation via public role assignment API missing app-level authorization"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.63.5"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/filebrowser/filebrowser/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.63.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54091"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-12T21:53:28Z",
    "nvd_published_at": "2026-06-25T19:16:41Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nFile Browser\u0027s public share handlers rebase the share owner\u0027s filesystem root to the shared directory and then evaluate descendant paths against the owner\u0027s global and per-user rules using the rebased relative path instead of the original path relative to the owner\u0027s scope.\n\nAs a result, an attacker who knows a public directory share URL can access files and subdirectories that the owner explicitly blocked with rules, as long as those blocked paths are located underneath the shared directory. In the simplest case this is an unauthenticated information disclosure through `GET /api/public/share/*` and `GET /api/public/dl/*`.\n\n### Details\nThe public share flow first resolves the original shared path under the owner\u0027s filesystem, but then switches `d.user.Fs` to a new `BasePathFs` rooted at the shared directory. The follow-up authorization check is still performed by `d.Check`, which compares the request path to rule strings using prefix matching.\n\nWhen the share target is a directory, the path passed to `d.Check` becomes relative to the shared directory, while the rules remain relative to the owner\u0027s original scope. A deny rule such as `/projects/private` therefore no longer matches a public share request for `/private/secret.txt`, even though the rebased filesystem resolves that request to the real path `/projects/private/secret.txt`.\n\nCore vulnerable code path:\n\n```go\n// http/public.go\nif file.IsDir {\n    basePath = filepath.Clean(link.Path)\n    filePath = ifPath\n}\n\nd.user.Fs = afero.NewBasePathFs(d.user.Fs, basePath)\n\nfile, err = files.NewFileInfo(\u0026files.FileOptions{\n    Fs:      d.user.Fs,\n    Path:    filePath,\n    Expand:  true,\n    Checker: d,\n})\n```\n\n```go\n// http/data.go and rules/rules.go\nfunc (d *data) Check(path string) bool {\n    allow := true\n    for _, rule := range d.settings.Rules {\n        if rule.Matches(path) {\n            allow = rule.Allow\n        }\n    }\n    for _, rule := range d.user.Rules {\n        if rule.Matches(path) {\n            allow = rule.Allow\n        }\n    }\n    return allow\n}\n\nfunc (r *Rule) Matches(path string) bool {\n    if path == r.Path {\n        return true\n    }\n    prefix := r.Path\n    if prefix != \"/\" \u0026\u0026 !strings.HasSuffix(prefix, \"/\") {\n        prefix += \"/\"\n    }\n    return strings.HasPrefix(path, prefix)\n}\n```\n\nThe issue is reachable from the public endpoints registered in `http/http.go` for `/api/public/share/*` and `/api/public/dl/*`.\n\n### PoC\nThe attacker only needs a directory share URL. No authenticated session is required if the share is not password protected.\n\nReproduction flow:\n\n1. Prepare a directory owned by a normal user, for example `/projects/`.\n2. Inside it, create a sensitive child path such as `/projects/private/secret.txt`.\n3. Configure a deny rule for the share owner that blocks `/projects/private`.\n4. Have the owner create a public share for `/projects/`.\n5. Request the blocked child path through the public share endpoints.\n\nPoC:\n\n```bash\n# owner creates a public share for /projects/\ncurl -s -X POST \u0027http://HOST/api/share/projects/\u0027 \\\n  -H \u0027X-Auth: \u003cOWNER_JWT\u003e\u0027 \\\n  -H \u0027Content-Type: application/json\u0027 \\\n  -d \u0027{}\u0027\n```\n\nThe response contains a share hash such as:\n\n```text\n{\"hash\":\"\u003cHASH\u003e\",\"path\":\"/projects/\",\"userID\":2,\"expire\":0}\n```\n\nThe attacker can then access a rule-blocked file below the shared directory:\n\n```bash\ncurl -i \u0027http://HOST/api/public/dl/\u003cHASH\u003e/private/secret.txt\u0027\n```\n\nA blocked subdirectory can also be listed directly:\n\n```bash\ncurl -i \u0027http://HOST/api/public/share/\u003cHASH\u003e/private/\u0027\n```\n\nthe server returns `200 OK` and serves the file content or directory listing, even though the share owner\u0027s rules should have made that path inaccessible.\n\n### Impact\nThis flaw allows public share recipients to read files and browse directories that the share owner explicitly intended to block with File Browser rules. Because the vulnerable path is the public share feature, the exposure can be unauthenticated and internet-reachable whenever a share link is exposed.\n\nIn practical deployments, this can disclose secrets, configuration files, backup material, private project directories, or any other content that administrators or users attempted to hide beneath a shared parent directory using the built-in rule system.",
  "id": "GHSA-j9jx-hp4c-ghhh",
  "modified": "2026-07-21T14:43:25Z",
  "published": "2026-06-12T21:53:28Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-j9jx-hp4c-ghhh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54091"
    },
    {
      "type": "WEB",
      "url": "https://github.com/filebrowser/filebrowser/commit/e07c59df0b850f5924d5b1683e8609661ddcf534"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/filebrowser/filebrowser"
    },
    {
      "type": "WEB",
      "url": "https://github.com/filebrowser/filebrowser/releases/tag/v2.63.6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "File Browser has incorrect access control for public directory shares via rule path rebasing"
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-27793"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-08-12T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "ntermittent authorization failure in aaa tacacs+ with Brocade Fabric OS versions before Brocade Fabric OS v9.0.1b and after 9.0.0, also in Brocade Fabric OS before Brocade Fabric OS v8.2.3a and after v8.2.0 could cause a user with a valid account to be unable to log into the switch.",
  "id": "GHSA-j9pj-ff73-q8xm",
  "modified": "2022-05-24T19:10:57Z",
  "published": "2022-05-24T19:10:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-27793"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20210819-0001"
    },
    {
      "type": "WEB",
      "url": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2021-1553"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}