CVE-2026-44460

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44460", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-06T15:49:25.193Z", "datePublished": "2026-05-27T16:39:12.264Z", "dateUpdated": "2026-05-28T14:13:48.371Z"}, "containers": {"cna": {"title": "FileRise: TOTP Bypass via Setup Endpoint Disclosing Existing Secret", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-287", "lang": "en", "description": "CWE-287: Improper Authentication", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-306", "lang": "en", "description": "CWE-306: Missing Authentication for Critical Function", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/error311/FileRise/security/advisories/GHSA-84hw-8g73-v3f8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/error311/FileRise/security/advisories/GHSA-84hw-8g73-v3f8"}], "affected": [{"vendor": "error311", "product": "FileRise", "versions": [{"version": "< 3.12.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-27T16:39:12.264Z"}, "descriptions": [{"lang": "en", "value": "FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.12.0, /api/totp_setup.php is callable from a session that has only passed the password check (state pending_login_user). When the target account already has TOTP configured, the endpoint decrypts and returns the user's existing TOTP secret inside the QR PNG instead of refusing or generating a new secret. An attacker who already possesses the victim's password can therefore retrieve the live TOTP secret, derive a valid one-time code, submit it to /api/totp_verify.php, and obtain a fully authenticated session without ever possessing the victim's authenticator device. This vulnerability is fixed in 3.12.0."}], "source": {"advisory": "GHSA-84hw-8g73-v3f8", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/error311/FileRise/security/advisories/GHSA-84hw-8g73-v3f8", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-28T14:13:39.459794Z", "id": "CVE-2026-44460", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-28T14:13:48.371Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44460", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-28T14:13:39.459794Z"}}}], "references": [{"url": "https://github.com/error311/FileRise/security/advisories/GHSA-84hw-8g73-v3f8", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-28T14:13:20.521Z"}}], "cna": {"title": "FileRise: TOTP Bypass via Setup Endpoint Disclosing Existing Secret", "source": {"advisory": "GHSA-84hw-8g73-v3f8", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "error311", "product": "FileRise", "versions": [{"status": "affected", "version": "< 3.12.0"}]}], "references": [{"url": "https://github.com/error311/FileRise/security/advisories/GHSA-84hw-8g73-v3f8", "name": "https://github.com/error311/FileRise/security/advisories/GHSA-84hw-8g73-v3f8", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.12.0, /api/totp_setup.php is callable from a session that has only passed the password check (state pending_login_user). When the target account already has TOTP configured, the endpoint decrypts and returns the user's existing TOTP secret inside the QR PNG instead of refusing or generating a new secret. An attacker who already possesses the victim's password can therefore retrieve the live TOTP secret, derive a valid one-time code, submit it to /api/totp_verify.php, and obtain a fully authenticated session without ever possessing the victim's authenticator device. This vulnerability is fixed in 3.12.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306: Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-27T16:39:12.264Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44460", "state": "PUBLISHED", "dateUpdated": "2026-05-28T14:13:48.371Z", "dateReserved": "2026-05-06T15:49:25.193Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-27T16:39:12.264Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "FileRise", "vendor": "error311", "versions": [{"status": "affected", "version": "< 3.12.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.12.0, /api/totp_setup.php is callable from a session that has only passed the password check (state pending_login_user). When the target account already has TOTP configured, the endpoint decrypts and returns the user's existing TOTP secret inside the QR PNG instead of refusing or generating a new secret. An attacker who already possesses the victim's password can therefore retrieve the live TOTP secret, derive a valid one-time code, submit it to /api/totp_verify.php, and obtain a fully authenticated session without ever possessing the victim's authenticator device. This vulnerability is fixed in 3.12.0."}, {"lang": "es", "value": "FileRise es un gestor de archivos autoalojado basado en web con carga de m\u00faltiples archivos, edici\u00f3n y operaciones por lotes. Antes de la versi\u00f3n 3.12.0, /api/totp_setup.php es invocable desde una sesi\u00f3n que solo ha pasado la verificaci\u00f3n de contrase\u00f1a (estado pending_login_user). Cuando la cuenta objetivo ya tiene TOTP configurado, el endpoint descifra y devuelve el secreto TOTP existente del usuario dentro del PNG del QR en lugar de rechazar o generar un nuevo secreto. Un atacante que ya posee la contrase\u00f1a de la v\u00edctima puede, por lo tanto, recuperar el secreto TOTP activo, derivar un c\u00f3digo de un solo uso v\u00e1lido, enviarlo a /api/totp_verify.php y obtener una sesi\u00f3n completamente autenticada sin poseer nunca el dispositivo autenticador de la v\u00edctima. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 3.12.0."}], "id": "CVE-2026-44460", "lastModified": "2026-10-26T11:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44460", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-28T14:13:39.459794Z", "version": "2.0.3"}}]}, "published": "2026-05-27T18:16:23.707", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/error311/FileRise/security/advisories/GHSA-84hw-8g73-v3f8"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/error311/FileRise/security/advisories/GHSA-84hw-8g73-v3f8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-306"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.12.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "FileRise", "source": "cna", "vendor": "error311"}, "product": "filerise", "vendor": "error311"}], "created": "2026-05-27T21:15:25.915838+00:00", "updated": "2026-05-28T02:15:03.983723+00:00", "vendors": ["error311", "error311$PRODUCT$filerise"]}