This vulnerability allows an unauthenticated visitor to create an account that automatically receives administrator rights. When the application is configured with default permissions that grant admin access and self‑registration is enabled, the signup handler applies these defaults without removing admin privileges. Consequently, a newly registered user can manage files, users, and server settings with unrestricted authority, leading to complete compromise of confidentiality, integrity, and availability of the system.

The Product is File Browser version 2.61.2 and earlier, specifically the filebrowser:filebrowser application. The issue exists when the configuration allows public signup and the default permissions include admin rights. All installations with these settings are affected.

The vulnerability has a maximum CVSS score of 10 and a very low EPSS score (<1%). It is not listed in CISA’s KEV catalog, indicating no widespread exploitation yet. The likely attack vector is an unauthenticated request to the public registration API when signup is enabled and default admin rights are present. An attacker can create an administrator account without authentication, then use that account to gain full control over files, users, and system settings.