FileBrowser Quantum lets users share files with password protection, but the API mistakenly exposes a direct download URL in the share details. A recipient who merely has the share link can download the file without providing the password, effectively bypassing the intended authorization. This flaw allows an unauthenticated attacker to obtain confidential files and poses a risk of data leakage. The issue aligns with CWE‑200 (Information Exposure), CWE‑287 (Improper Authentication), and CWE‑288 (Improper Permission Assignment).

The vulnerability affects gtsteffaniak's FileBrowser Quantum. Versions prior to 1.1.3‑stable on the stable branch and before 1.2.6‑beta on the beta branch are susceptible. The problem is resolved in those releases and all newer versions.

With a CVSS score of 7.1 the severity is high; however, the EPSS score is less than 1%, indicating a low likelihood of exploitation at present. The flaw is not listed in the CISA KEV catalog. The attack vector is inferred to be a web‑API IDOR that returns a direct download link to any user who possesses the share URL, requiring no additional authentication.