FileBrowser Quantum Incomplete Remediation of CVE-2026-27611: Password-Protected Share Bypass via /public/api/share/info

Vulnerability

Overview

The vulnerability stems from an incomplete remediation of CVE-2026-27611 in FileBrowser Quantum, a self-hosted file manager. The issue resides in the /public/api/share/info endpoint, which continues to disclose a downloadURL containing an authentication token even when a share is password-protected, as demonstrated by the advisory [3]. Prior versions (before 1.2.2-stable and 1.3.1-beta) still leak the token, allowing anyone with the share hash to download files without supplying the required password.

Exploitation

Process

An attacker who knows or discovers a share hash can directly query the public API endpoint using a simple HTTP request, as shown in the advisory: a curl command to /public/api/share/info?hash=(share-hash) returns a downloadURL field that includes a token parameter [3]. The example response in the advisory confirms that even when hasPassword is true, the downloadURL is included in the response, and the token within that URL can be used to download files without authentication [3].

Impact

Successful exploitation allows an unauthenticated attacker to bypass password protection on publicly shared files and download them directly. The token in the downloadURL provides a time-limited or one-time access credential, but its exposure undermines the intended access control mechanism [1][3]. This can lead to unauthorized exposure of sensitive files shared with password protection.

Mitigation

The vulnerability is fixed in versions 1.2.2-stable and 1.3.1-beta, as noted in the release notes for v1.2.2-stable [4]. Users running any prior version should upgrade immediately. The advisory recommends updating to the latest stable or beta release that includes the full patch [3].