FileRise Proxy Auth Bypass Lets Attackers Impersonate Admins Without Credentials

FileRise version 3.16.0 addresses a high-severity authentication bypass in its proxy configuration. The vulnerability, tracked as CVE-2026-57489, stems from the application trusting reverse-proxy identity headers without verifying the request source. Environments where the backend application port is directly accessible and proxy-header authentication is active are exposed to this risk.

Root cause

The issue arises when FileRise deployments enable the AUTH_BYPASS setting. In this mode, the software accepts the configured reverse-proxy identity header to establish user identity. However, it fails to confirm that the incoming request originated from a trusted proxy listed in FR_TRUSTED_PROXIES. This logic gap allows external actors to spoof authentication data if they can reach the backend directly.

Attack path

An unauthenticated attacker can exploit this by sending requests directly to the exposed backend port. By supplying a custom X-Remote-User header, the attacker asserts a specific user identity. The application grants a session for that asserted account, including administrator privileges, without requiring a password or multi-factor authentication. This effectively bypasses all standard login controls.

Affected versions

• FileRise versions prior to 3.16.0.
• Specifically, deployments that have enabled proxy-header authentication.
• Installations where the backend application port is reachable without an intermediary firewall or proxy restriction.

Mitigation

• Upgrade FileRise to version 3.16.0, which patches the authentication logic.
• Restrict network access to the backend application port so only trusted proxies can connect.
• Disable the AUTH_BYPASS setting if direct proxy authentication is not strictly required.
• Verify that FR_TRUSTED_PROXIES is correctly configured to limit trusted sources.

Signals worth monitoring

Security teams should review web server logs for requests containing X-Remote-User headers originating from unexpected IP addresses. Look for successful session creations or administrative actions without corresponding login attempts in authentication logs. Check for anomalous user activity, such as file deletions or permission changes, from accounts that rarely perform such tasks. Implement alerts for direct access attempts to backend ports that should be restricted to internal proxies only. Monitor for sudden spikes in API calls from untrusted sources.

What to do and how to stay safe: FileRise

• Audit your FileRise deployment to confirm whether AUTH_BYPASS is enabled and how proxy trust is configured.
• Ensure the backend port is not directly accessible from the internet or untrusted networks.
• Plan an upgrade to version 3.16.0 as soon as possible to close the authentication gap.
• Review recent access logs for signs of unauthorised session creation or privilege escalation.

Step-by-step guide: Out-of-band patches: what small businesses need to know

General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-57489?

The National Vulnerability Database rates the severity as 8.1, which is classified as high.

Which FileRise versions are affected?

All versions prior to 3.16.0 are affected, specifically those with proxy-header authentication enabled.

Is a patch available?

Yes, version 3.16.0 fixes this issue by correcting the proxy header verification logic.