Is CVE-2026-72839 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-72839?

CVE-2026-72839 has a CVSS v3 severity of CRITICAL (9.8).

Back

CVE-2026-72839

Description

filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is enabled with default CreateUserDir setting. Unauthenticated attackers can register accounts that inherit the server root scope with full create, modify, delete, rename, share, and download permissions, allowing unrestricted access to all files.