Security readout for executives and security teams
Plain-English summary
Internet-accessible filebrowser deployments may let anyone create an account and gain unrestricted access to every file the service can reach. Attackers could read, alter, delete, rename, share, or download data without prior credentials. The issue applies when self-signup is enabled with the default CreateUserDir setting.
Executive priority
Treat exposed, matching deployments as an immediate remediation priority. Disable public signup or isolate access, investigate recent registrations and file activity, and reduce filesystem privileges. Because no fixed version is identified in the supplied sources, require confirmation from the vendor advisory before declaring remediation complete.
Technical view
CVE-2026-72839 is a CWE-266 privilege-assignment flaw affecting filebrowser through 2.63.16. During self-registration, improper scope and permission restrictions can assign the server-root scope and full file privileges to an unauthenticated registrant. Its CVSS 3.1 score is 9.8 because exploitation is remote, low-complexity, requires no privileges or user interaction, and can compromise confidentiality, integrity, and availability.
Likely exposure
Highest risk exists where filebrowser through 2.63.16 is reachable by untrusted users, self-signup is enabled, and CreateUserDir remains at its default. Impact extends to all files accessible through the service account and configured server root. The supplied affected-version metadata is inconsistent, so deployments should confirm applicability against the vendor advisory.
Exploitation context
The condition appears remotely reachable through account signup and requires no existing account or user interaction. The supplied bundle reports no CISA KEV listing and provides no cited evidence of active exploitation. Ease of access and potential full-file control nevertheless create substantial risk where the vulnerable configuration is exposed.
Researcher notes
The core failure is unsafe authorization assignment during unauthenticated signup, not merely account creation. Exposure depends on configuration and the filesystem reach of the service. The bundle states “through 2.63.16,” but its structured affected entry lists version “0” with defaultStatus “unaffected”; rely on the vendor advisory for precise version interpretation and remediation status.
Mitigation direction
- Disable self-signup until vendor guidance is reviewed and remediation is confirmed.
- Restrict filebrowser access to trusted networks and authenticated users.
- Review and minimize the server root and filesystem permissions available to filebrowser.
- Check the vendor advisory for a fixed release or configuration-specific remediation.
- Preserve relevant registration, authentication, sharing, and file-operation logs for investigation.
Validation and detection
- Inventory filebrowser versions and identify deployments running 2.63.16 or earlier.
- Confirm whether self-signup is enabled and whether CreateUserDir uses its default setting.
- Review newly registered accounts for server-root scope or unexpectedly broad permissions.
- Examine logs for suspicious downloads, shares, deletions, renames, or modifications.
- Verify filebrowser's operating account cannot access unnecessary sensitive files.
- After remediation, confirm new accounts receive only intended directories and permissions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-266: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-72839 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9VulnCheckCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
9.3CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- GitHub Security Advisory (GHSA-6759-996p-gpj6)CVE reference, VulnCheck · vendor-advisory
- VulnCheck Advisory: filebrowser through 2.63.16 Privilege Escalation via SignupCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Privilege Assignment
Incorrect Privilege Assignment represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.