CVE-2026-3266 is a critical missing authorization flaw in OpenText Filr, scored CVSS 9.8. The record says unauthenticated users could obtain an XSRF token and make remote procedure calls with crafted programs. It affects Filr through 25.1.2. I could not load the vendor article, so read it for the fixed release.
What's affected
The NVD record says OpenText Filr is affected through version 25.1.2. The record does not state a fixed version, and the vendor article it links to (KM000045579) did not load for me, so the fixed release must be taken from that article or from OpenText support.
The record describes the result as an authentication bypass: an unauthenticated caller could get a session protection token and then invoke server procedures.
How to check if you're exposed
Find your Filr version in the administration console and compare it with 25.1.2. Any version up to and including 25.1.2 is in scope.
Next, find out who can reach the Filr web interface. Instances published directly to the internet face the highest risk, because the record describes the attacker as unauthenticated.
Finally, read the vendor article KM000045579 for the fixed release and any interim steps.
What to do now
- Read the OpenText advisory KM000045579 and note the fixed version.
- Apply the vendor fix as soon as your change process allows.
- Until then, restrict access to Filr to your VPN or known networks.
- Review access logs for unusual requests from addresses you do not know.
- Ask OpenText support if the advisory text is unclear for your deployment.
Why it matters
The class is CWE-862, missing authorization. A function that should check who is calling does not check, so anyone who can reach it can use it.
File sharing platforms hold documents from across a company, so a bypass of this kind matters even when the record gives few technical details. The record's KEV flag is false.
Quick check
Which version fixes this?
The record does not say. Use the OpenText advisory KM000045579 or ask the vendor, and do not guess.
Sources
Last reviewed: 19 October 2026.
