FileBrowser Quantum previously implemented a fix for CVE‑2026‑27611 that was later found incomplete. In affected releases, password‑protected shares continue to expose a tokenized download URL through the /public/api/share/info endpoint. This lapse allows an unauthenticated attacker to obtain a direct download link to resources that the share protection was intended to guard, thereby disclosing confidential data. The weakness aligns with CWE‑200 (Information Exposure), CWE‑306 (Missing Authentication), and CWE‑602 (Improper Verification of Authorization).

The vulnerability applies to gtsteffaniak’s FileBrowser Quantum web‑based file manager. All product releases prior to 1.2.2‑stable and 1.3.1‑beta are affected, including 1.2.1‑stable and 1.3.0‑beta. Users running these versions should consider them at risk.

The CVSS score of 7.5 denotes high severity, while the EPSS score of less than 1 % indicates a low probability of real‑world exploitation at this time. The weakness is not listed in the CISA KEV catalog, reflecting its relatively low prevalence. Attackers can exploit the flaw remotely by sending crafted requests to /public/api/share/info, revealing the download URL even when the share is password protected. No privilege escalation or code execution is involved, but the data exposure could support subsequent attacks.