FileRise is a self‑hosted web‑based file manager in which, prior to version 3.21.0, the client can disable form login, basic authentication, or OIDC login through configuration options. However, the server does not enforce these disable flags consistently, allowing a user with valid credentials for a disabled method to call the corresponding backend endpoint directly and authenticate successfully. This weakens the administrator’s login‑method policy and constitutes an Authentication Bypass (CWE‑287). The flaw requires the attacker to possess valid credentials; it does not permit credential‑free authentication.

The vulnerability affects installations of FileRise 3.20.x and earlier, any deployment where the client disables form login, basic auth, or OIDC login but the server does not enforce the same restriction. The vendor is error311, and the issue exists in all released versions before 3.21.0. Administrators who have disabled any of these methods should note that the policy can be circumvented until the server‑side fix is applied.

The CVSS score for the flaw is 5.4, indicating moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because an attacker must already have valid credentials for the disabled method, the attack is limited to individuals who have account access or can otherwise obtain one. The likely attack vector is a remote web‑service call from an authenticated user to the server API endpoint where the server incorrectly accepts the call. The vendor has released version 3.21.0 that removes this flaw, so patching is the recommended path to mitigate this risk.