File Browser allows users to create share links that enable others to download content. In versions prior to 2.63.1, when an administrator revokes a user’s Share and Download permissions, the system fails to re‑evaluate those permissions for existing links, meaning anyone who knows the URL can still download the file. This leads to unauthorized data disclosure and is classified under CWE‑863, Missing Authorization. The CVSS score of 8.2 indicates a high‑severity vulnerability.

The affected product is File Browser, a file‑management interface. All releases earlier than version 2.63.1 are impacted; the fix is included in 2.63.1 and subsequent releases.

With a CVSS score of 8.2 the risk is substantial. The EPSS score is not available and the issue is not listed in CISA’s KEV catalog, but the vulnerability can be exploited by anyone possessing a previously issued share link. Since no authentication is required and the flaw stems from a missing permission check, the attack vector is likely to be a simple URL request to the public download endpoint. The potential impact is full disclosure of files that were intended to be restricted after permission revocation.