Filebrowser before version 2.63.19 contains a permission bypass flaw in the /api/resources endpoint. When the checksum query parameter is used, the handler reads the entire target file, computes a hash, and returns the value without enforcing the Download permission check that other routes apply. This flaw does not undermine scope or path authorization but grants an authenticated user who is denied download rights a content-hash oracle on any file within the same scope, allowing confirmation of known or guessed content, detecting changes, and performing offline brute‑force attacks on low‑entropy files. The weakness is a classic information‑leak flaw identified as CWE‑200.

The vulnerability affects the Filebrowser product prior to release 2.63.19 from the filebrowser vendor. Any installation using a version earlier than 2.63.19 and exposing the /api/resources endpoint is impacted.

The CVSS score of 5.3 indicates a moderate severity with limited exploitability. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an authenticated local user possessing filebrowser access but lacking Perm.Download privileges. The attacker must target a file within the same scope and request its checksum via the API. Once performed, the attacker obtains hash values that can be used to confirm or brute‑force file contents, but does not gain arbitrary file download or execution capabilities.