CVE-2026-44460 affects FileRise, a self-hosted web-based file manager. The vulnerability arises because the /api/totp_setup.php endpoint is callable from a session state that has only passed password verification (pending_login_user) but is not fully authenticated. When the user already has TOTP configured, the endpoint decrypts and returns the existing TOTP secret inside the QR PNG instead of denying access or generating a new secret. An attacker who knows the victim's password can retrieve this secret, derive valid one-time codes, and use /api/totp_verify.php to obtain a fully authenticated session without possessing the victim's authenticator device. This flaw allows bypassing two-factor authentication and compromises account security. The issue is resolved in FileRise version 3.12.0.

An attacker who has obtained a victim's password can exploit this vulnerability to retrieve the victim's live TOTP secret, bypass two-factor authentication, and gain full authenticated access to the victim's account. This results in a complete compromise of account confidentiality and integrity. The vulnerability does not affect availability and requires the attacker to already know the victim's password.

This vulnerability is fixed in FileRise version 3.12.0. Users should upgrade to version 3.12.0 or later to remediate this issue. Since no official patch link or advisory is provided, verify the upgrade availability from the vendor's official channels. Patch status is not yet confirmed beyond the stated fix version—check the vendor advisory for current remediation guidance.