CVE-2026-23849

Description

File Browser Vulnerable to Username Enumeration via Timing Attack in /api/login in github.com/filebrowser/filebrowser

Affected packages (4)

• Go/github.com/filebrowser/filebrowserfrom 0, <= 1.11.0
• Go/github.com/filebrowser/filebrowserfrom 0
• Go/github.com/filebrowser/filebrowser/v2from 0, < 2.55.0
• Go/github.com/filebrowser/filebrowser/v2from 0, < 2.55.0

CVSS scores

References (4)

• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2026-23849
• PATCHhttps://github.com/filebrowser/filebrowser
• WEBhttps://github.com/filebrowser/filebrowser/commit/24781badd413ee20333aba5cce1919d676e01889
• WEBhttps://github.com/filebrowser/filebrowser/security/advisories/GHSA-43mm-m3h2-3prc