CVE-2026-69193: CWE-307: Improper Restriction of Excessive Authentication Attempts in error311 FileRise

FileRise versions before 3.21.0 implement failed login attempt tracking based on the combination of source IP address and username. This design flaw allows an attacker to circumvent per-IP rate limiting by rotating usernames, effectively resetting the attempt count for each username and enabling password spraying attacks from one IP address beyond the intended limit. Although per-user limits still apply and can cause throttling for targeted accounts, the vulnerability weakens the overall brute force protection. The flaw is addressed in FileRise version 3.21.0.

An unauthenticated remote attacker can perform password spraying attacks from a single IP address by rotating usernames, bypassing the intended rate limiting based on IP and username combination. This increases the risk of unauthorized access through brute force attacks. The vulnerability does not directly impact confidentiality or integrity but can lead to denial of service due to account lockouts or increased attack surface. The CVSS score is 6.5 (medium severity) with low attack complexity and no privileges required.

Upgrade FileRise to version 3.21.0 or later, where this issue is fixed. No other mitigations are specified. Patch status is confirmed as fixed in 3.21.0.