FileRise is a self-hosted web-based file management application supporting multi-file upload, editing, and batch operations. Versions 2.3.7 through 3.10.0 contain an authorization flaw identified as CVE-2026-33477 (CWE-863). The vulnerability exists in the /api/file/snippet.php endpoint, which provides snippet previews of files for hover preview functionality. The flaw arises because the server-side authorization incorrectly enforces the 'read_own' permission, allowing authenticated users with this limited access to retrieve snippet content from files uploaded by other users within the same folder. This means that users can view portions of files they should not have access to, violating confidentiality. The vulnerability does not permit file modification or deletion, nor does it affect availability. Exploitation requires authentication but no additional user interaction. The issue was addressed and fixed in FileRise version 3.11.0. The CVSS v3.1 base score is 4.3, reflecting low complexity and network attack vector but limited impact to confidentiality only. No public exploits or active exploitation have been reported to date.

The primary impact of this vulnerability is unauthorized disclosure of file snippet content within shared folders, potentially exposing sensitive information to users who should only have limited read access to their own files. This can lead to breaches of confidentiality and privacy, especially in environments where multiple users share folders but have segregated access rights. Although the vulnerability does not allow modification or deletion of files, the leakage of file snippets could expose intellectual property, personal data, or other confidential information. Organizations relying on FileRise for secure file management may face compliance risks and reputational damage if sensitive data is inadvertently exposed. The risk is heightened in multi-tenant or collaborative environments where users have overlapping folder access but require strict data separation.

The most effective mitigation is to upgrade FileRise to version 3.11.0 or later, where the authorization flaw has been corrected. Until upgrading is possible, organizations should consider restricting access to the affected /api/file/snippet.php endpoint via network controls or web application firewalls to prevent unauthorized snippet retrieval. Additionally, review and tighten folder access permissions to minimize the number of users with overlapping folder access, reducing the attack surface. Implement monitoring and logging of API access to detect unusual or unauthorized snippet retrieval attempts. Educate users about the importance of limiting file sharing within folders to trusted parties only. Finally, conduct regular audits of FileRise deployments to ensure they are running supported, patched versions.