CVE-2026-32760 is a critical flaw in File Browser, scored CVSS 9.8. When self registration is on and the default user permissions include admin, every visitor who signs up becomes an administrator. Versions 2.61.2 and below are affected and 2.62.0 fixes it, so upgrade and review your defaults.
What's affected
The GitHub advisory lists the Go module github.com/filebrowser/filebrowser/v2 at 2.61.2 and below, with 2.62.0 as the patched version. The 2.62.0 changelog includes the entry "signup handler shouldn't create admins".
The condition has two parts. Signup must be enabled, and the default user permissions must have admin set. If either one is off, the advisory's scenario does not apply, although you should still upgrade.
How to check if you're exposed
Read the running version:
filebrowser version
Then inspect the settings:
filebrowser config cat
Look at the signup setting and at the permissions listed under the user defaults. If signup is true and admin is true in defaults, anyone who can reach the sign up page can become an admin.
You can also check the Settings page in the web interface, under global and user default settings.
What to do now
- Upgrade File Browser to 2.62.0 or later.
- Turn off signup if you do not need open registration.
- Remove admin from the default user permissions.
- Review the user list and delete admin accounts you do not recognize.
- Check the files the instance serves for changes you did not make.
Other changes in the 2.62.0 changelog are worth knowing about. They include a fix that makes the share permission depend on the share download permission, a fix that cleans the path in the patch handler, and a docs notice about running behind a proxy.
After you upgrade, check the user list one more time. Upgrading stops new admin accounts from being created at signup, but it does not remove ones that were created before. Delete any account you cannot match to a person, then rotate the password of every real admin.
Why it matters
The weaknesses are CWE-269, improper privilege management, and CWE-284, improper access control. The advisory says the signup handler applied all default settings to the new user, including the admin permission, with no step that removed admin from a self registered account.
An unusual setup is needed, so the practical risk depends on how you configured the tool. But a safe default is not the same as a safe code path. The fix makes the code refuse to create admins at signup whatever the defaults say. The record's KEV flag is false.
Quick check
Am I safe if signup is off?
The advisory scenario needs signup on. Turning it off removes that path, but upgrade anyway.
Sources
Last reviewed: 19 October 2026.
