FileRise, a web‑based file manager, mis‑handled the AUTH_BYPASS feature when proxy‑header authentication was enabled. The backend would accept an arbitrary X-Remote-User header from a reverse‑proxy identity header without verifying that the request originated from a trusted proxy, allowing anyone able to reach the backend port directly to fabricate a session for any account, including administrators, without a password or MFA. This flaw provides full authentication bypass and grants attackers complete control of the affected instance.

Deployments running FileRise before version 3.16.0 that have AUTH_BYPASS enabled and expose the internal backend port to untrusted networks are vulnerable.

The CVSS base score is 8.1, indicating a high‑severity vulnerability. An EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. Exploitation requires direct access to the backend port and the AUTH_BYPASS configuration; once conditions are met, an unauthenticated attacker can obtain unlimited administrative rights.