{"metadata": {"vulnerability": "cve-2026-54089", "count": 15, "kinds": {"milestone": 4, "sighting": 3, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-06-11T18:44:47.761Z", "date_only": false, "value": "2026-06-11T18:44:47.761Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-54089", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-06-25T17:46:13.119Z", "date_only": false, "value": "2026-06-25T17:46:13.119Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-54089", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-06-25T17:46:13.119Z", "date_only": false, "value": "2026-06-25T17:46:13.119Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "cve-2026-54089", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-06-25T18:33:12.379Z", "date_only": false, "value": "2026-06-25T18:33:12.379285Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-54089", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-06-25T18:33:12.379Z", "date_only": false, "value": "2026-06-25T18:33:12.379285Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-54089", "record": "FKIE_CVE-2026-54089", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-06-25T18:33:37.531Z", "date_only": false, "value": "2026-06-25T18:33:37.531Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-54089", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-06-25T18:33:37.531Z", "date_only": false, "value": "2026-06-25T18:33:37.531Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-54089", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-06-25T19:16:40Z", "date_only": false, "value": "2026-06-25T19:16:40Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-XQP3-JQ6G-X3QM", "record": "GHSA-XQP3-JQ6G-X3QM", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-06-25T19:16:40.827Z", "date_only": false, "value": "2026-06-25T19:16:40.827", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-54089", "record": "FKIE_CVE-2026-54089", "field": "published"}, {"timestamp": "2026-06-25T19:58:30.847Z", "date_only": false, "value": "2026-06-25T19:58:30.847", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-54089", "record": "FKIE_CVE-2026-54089", "field": "lastModified"}, {"timestamp": "2026-07-10T19:27:13Z", "date_only": false, "value": "2026-07-10T19:27:13Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-XQP3-JQ6G-X3QM", "record": "GHSA-XQP3-JQ6G-X3QM", "field": "published"}, {"timestamp": "2026-07-10T19:27:13Z", "date_only": false, "value": "2026-07-10T19:27:13Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-XQP3-JQ6G-X3QM", "record": "GHSA-XQP3-JQ6G-X3QM", "field": "modified"}, {"timestamp": "2026-07-10T20:16:04.035Z", "date_only": false, "value": "2026-07-10T20:16:04.035535Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqcxoiwmmg2z", "record": "CVE-2026-54089", "field": "creation_timestamp", "uuid": "6211496f-b390-48e3-b56d-fe8e541a4e48", "content": "CVE-2026-54089 - filebrowser\nWhen FileBrowser is configured to use proxy authentication, an attacker can impersonate any user, including administrators, by sending a fake HTTP header. This allows the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#filebrowser #Golang #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mqcxoiwmmg2z"}, {"timestamp": "2026-07-10T20:35:14.770Z", "date_only": false, "value": "2026-07-10T20:35:14.770110Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-xqp3-jq6g-x3qm", "record": "CVE-2026-54089", "field": "creation_timestamp", "uuid": "62fbf702-8898-4db5-becf-cd6ca79649d8", "url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-xqp3-jq6g-x3qm"}, {"timestamp": "2026-07-11T03:42:32.121Z", "date_only": false, "value": "2026-07-11T03:42:32.121308Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/3054e318d0e890a38da4e9f158827df1", "record": "CVE-2026-54089", "field": "creation_timestamp", "uuid": "12db9681-864e-49f3-9a36-ca4370041974", "content": "# CVE-2026-54089: CVE-2026-54089: Authentication Bypass by Spoofing in File Browser\n\n> **CVSS Score:** 9.1\n> **Published:** 2026-07-10\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54089\n\n## Summary\nCVE-2026-54089 is a critical authentication bypass vulnerability in File Browser affecting instances configured with proxy-based authentication. An unauthenticated remote attacker with direct network access can impersonate arbitrary users or register new accounts by spoofing configured HTTP headers.\n\n## TL;DR\nUnauthenticated network-adjacent or remote attackers can gain full administrative access to File Browser instances by forging identity headers when the service is exposed without a validating reverse proxy.\n\n## Technical Details\n\n- **CWE ID**: CWE-290\n- **Attack Vector**: Network\n- **CVSS v3.1**: 9.1 (Critical)\n- **EPSS Score**: 0.00337\n- **Exploit Status**: None\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- File Browser deployments configured with proxy authentication (auth.method=proxy) that are directly exposed to untrusted networks\n- **File Browser**: >= 2.0.0-rc.1 (Fixed in: `None`)\n\n## Mitigation\n\n- Bind File Browser exclusively to localhost (127.0.0.1) or an internal isolated network.\n- Configure the upstream reverse proxy to sanitize, strip, or overwrite incoming client-supplied identity headers.\n- Disable proxy authentication if network-level source verification and header sanitation cannot be enforced.\n\n**Remediation Steps:**\n1. Verify the configured listen address in File Browser configuration or CLI command line flags (ensure it uses -a 127.0.0.1).\n2. Inspect the upstream proxy (e.g., Nginx, Traefik) and insert rules to clear client-supplied versions of the designated authentication header.\n3. Test vulnerability exposure by making a direct curl query to /api/login from an external network segment with the header set to verify it is blocked.\n\n## References\n\n- [GitHub Security Advisory GHSA-xqp3-jq6g-x3qm](https://github.com/filebrowser/filebrowser/security/advisories/GHSA-xqp3-jq6g-x3qm)\n- [File Browser Proxy Authentication Code](https://github.com/filebrowser/filebrowser/blob/main/auth/proxy.go)\n- [File Browser Authentication Endpoint Code](https://github.com/filebrowser/filebrowser/blob/main/http/auth.go)\n- [NVD CVE-2026-54089 Details](https://nvd.nist.gov/vuln/detail/CVE-2026-54089)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54089) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/3054e318d0e890a38da4e9f158827df1"}]}