The vulnerability arises because FileRise stores the administrator flag in remember‑me tokens and restores that stale value during automatic login instead of re‑evaluating the account’s current role. If an administrator is demoted but still possesses a remember‑me token issued before the role change, the token will grant continued administrator access. The attacker can keep or re‑create privileged tokens after a role change, allowing persistent high‑privilege access. This is a classic privilege escalation weakness relying on improper handling of authentication tokens (CWE‑613).

FileRise, version prior to 3.16.0. The issue is fixed in release v3.16.0; earlier versions retain the flaw until the token is rotated or the software is updated. Users running any FileRise version older than 3.16.0 are affected; those on 3.16.0 or newer are not vulnerable.

The CVSS score of 6.8 indicates a moderate severity rating. No EPSS data is available, so the exploitation likelihood cannot be quantified, but the absence of a KEV listing suggests no widely reported public exploitation yet. The vulnerability is exploitable only if the attacker can obtain a pre‑demotion remember‑me token, such as by compromising a user’s browser or intercepting traffic. Given the static nature of the token’s privilege field, once issued the token can be reused until rotated, providing a window for attackers to retain elevated access.