FileRise, a self-hosted web‑based file manager, stores failed TOTP verification attempts in the session. An attacker who already has a target account’s primary credentials can restart the login workflow in a new session and reset the second‑factor attempt counter, allowing continued online TOTP guessing beyond the intended five‑attempt limit. This flaw permits an attacker to perform repeated guesses of TOTP values, potentially achieving unauthorized access to the victim’s account and sensitive file storage.

Error311’s FileRise product is affected. Versions earlier than 3.23.0 exhibit the issue. The fix is released in version 3.23.0 and administrators should verify the build number and apply the update if they are running any pre‑3.23.0 release.

The CVSS score of 8.1 indicates a high impact on confidentiality and integrity of the user’s data. The EPSS score is unavailable, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited exploitation data. Because the flaw relies on the attacker’s possession of valid primary credentials, the attack vector is remote via the web interface. The mitigation is straightforward: upgrade to a fixed release; without the fix, an attacker can repeatedly attempt TOTP codes until successful, resulting in a full account takeover.