CVE-2026-32760

Description

File Browser Signup Grants Admin When Default Permissions Include Admin in github.com/filebrowser/filebrowser

How to fix CVE-2026-32760

To remediate CVE-2026-32760, upgrade the affected package to a fixed version below.

• Go/github.com/filebrowser/filebrowser—no fix listed
• Go/github.com/filebrowser/filebrowser/v2—upgrade to 2.62.0 or later
• Go/github.com/filebrowser/filebrowser/v2—upgrade to 2.62.0 or later

Is CVE-2026-32760 being exploited?

Low — EPSS is 0.0%, meaning exploitation activity has not been observed at scale.

Affected packages (3)

• from 0
• from 0, < 2.62.0
• from 0, < 2.62.0

CVSS scores

References (5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-32760
• PATCHgithub.com/filebrowser/filebrowser
• WEBgithub.com/filebrowser/filebrowser/commit/a63573b67eb302167b4c4f218361a2d0c138deab
• WEBgithub.com/filebrowser/filebrowser/releases/tag/v2.62.0