This vulnerability allows an attacker who already knows a victim’s password to retrieve the account’s existing TOTP secret from the /api/totp_setup.php endpoint. The endpoint, when called by a session that has passed only the password check, decrypts and returns the stored secret inside a QR PNG, rather than refusing or generating a new one. With the secret in hand, the attacker can create a valid one‑time code, submit it to /api/totp_verify.php, and authenticate as the victim without using the authenticator device. The weakness is a combination of information disclosure (CWE‑200), broken authentication (CWE‑287), and insecure credentials access (CWE‑306), resulting in full session takeover. The impact is a compromise of confidentiality, integrity, and availability of the affected system for the victim account.

FileRise, a self‑hosted web‑based file manager. All versions prior to 3.12.0 are vulnerable; the fix was released in 3.12.0.

The CVSS score of 7.4 indicates serious impact. EPSS is not available, and the issue is not listed in CISA KEV, but the vulnerability can be exploited by anyone who has already compromised a user’s password. The likely attack vector is remote web, requiring disclosure of credentials but not privileged access to the authenticator device. Once exploited, the attacker can gain authenticated sessions and perform any actions the victim can.