CVE-2026-57489: CWE-290: Authentication Bypass by Spoofing in error311 FileRise

CVE-2026-57489 is an authentication bypass vulnerability in FileRise, a self-hosted web-based file manager. When the AUTH_BYPASS feature is enabled, FileRise trusts the configured reverse-proxy identity header without verifying that the request originates from trusted proxies (FR_TRUSTED_PROXIES). If the backend application port is directly reachable, an unauthenticated attacker can supply the X-Remote-User header to impersonate any user, including administrators, thereby bypassing password and multi-factor authentication. This flaw affects versions prior to 3.16.0 and requires specific deployment conditions (proxy-header authentication enabled and backend port exposed). The vulnerability is resolved in version 3.16.0.

Successful exploitation allows an unauthenticated attacker to gain unauthorized access to FileRise user sessions, including administrator accounts, without needing passwords or multi-factor authentication. This can lead to full compromise of the affected FileRise instance, including unauthorized file access and administrative control. The impact is high due to the complete bypass of authentication controls.

Upgrade FileRise to version 3.16.0 or later, where this vulnerability is fixed. Additionally, ensure that the backend application port is not directly accessible from untrusted networks and that proxy-header authentication is configured securely, limiting trusted proxies to prevent spoofing of identity headers.