FileRise allows an authenticated user with a valid CSRF token to cancel an existing TOTP factor or initiate a new TOTP enrollment without reauthenticating with the account’s password. The enrollment procedure generates a new secret and activates it prior to verifying control of the authenticator, enabling an actor who holds the session to force the account into an unmanaged MFA state. The vulnerability is rooted in missing authentication for privileged functions (CWE‑306) and the insecure handling of user secrets (CWE‑620). This lowers the protection barrier for theft or compromise of user accounts, potentially granting a malicious actor escalation of privileges within the web application.

The flaw exists in the FileRise self‑hosted file manager, affecting all instances with versions older than 3.23.0 deployed by the vendor error311. Any installation that relies on TOTP based second‑factor authentication for user or administrative access is susceptible.

With a CVSS score of 6.5, the weakness is considered moderate severity. An exploit requires a valid authenticated session and CSRF token, both of which can be acquired through session hijacking or by user compromise. The EPSS score is not reported, and the vulnerability is not listed in the CISA KEV catalog, indicating no known public exploitation yet. Nonetheless, the lack of step‑up reauthentication makes it easier for an attacker in possession of a session to disable or replace the account’s two‑factor protection, thereby increasing the risk of unauthorized access and data exfiltration.