File Browser Signup Grants Admin When Default Permissions Include Admin
Date: 2026-03
Affected: go/github.com/filebrowser/filebrowser/v2
Attack vector: rce
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2026-32760
CWE: CWE-269
CWE-284

## Summary Any unauthenticated visitor can register a full administrator account when self-registration ( signup = true ) is enabled and the default user permissions have perm.admin = true. The signup handler blindly applies all default settings - including Perm.Admin - to the new user without any server-side guard that strips admin from self-registered accounts. ## Details **Affected file:** http/auth.go **Vulnerable code:** ```go user := &users.User{ Username: info.Username, } d.settings.Defaults.Apply(user) ``` **`settings.UserDefaults.Apply` (settings/defaults.go):** ```go func (d *UserDefaults) Apply(u *users.User) { u.Perm = d.Perm ... } ``` **Settings API permits Admin in defaults (http/settings.go):** ```go var settingsPutHandler = withAdmin(func(_ http.ResponseWriter, r *http.Request, d *data) (int, error) { ... d.settings.Defaults = req.Defaults ... }) ``` The signupHandler is supposed to create unprivileged accounts for new visitors. It contains no explicit user.Perm.Admin = false reset after Defaults.Apply. If an administrator (intentionally or accidentally) configures defaults.perm.admin = true and also enables signup, every account created via the public registration endpoint is an administrator with full control over all files, users, and server settings. ## Demo Server Setup ```bash docker run -d --name fb-test \ -p 8080:80 \ -v /tmp/fb-data:/srv \ filebrowser/filebrowser:v2.31.2 ADMIN_TOKEN=$(curl -s -X POST http://local


Mitigations:

Architectural layers (MAESTRO):