An authorization bypass flaw in the FileMaker Server Web Publishing Engine allows an attacker to send HTTP requests containing an extended privilege header. When the Custom Web Publishing with XML option is disabled, these crafted requests circumvent the restriction and expose the XML Web Publishing interface. The flaw is a classic improper authorization error and can let unauthenticated users view or modify data exposed through that interface, compromising confidentiality and integrity of database contents.

Claris FileMaker Server versions prior to 26.0.3 that have the Custom Web Publishing with XML setting disabled are affected. The fix is delivered in version 26.0.3 and later.

The vulnerability can be exploited over the network with no authentication and no special tooling beyond the ability to craft the extended privilege header. The EPSS score of less than 1% indicates a very low likelihood of exploitation, and the flaw is not listed in CISA KEV. However, once bypassed the attacker gains unrestricted access to the XML Web Publishing interface, which may expose sensitive data. The high CVSS score of 9.1 reflects the severity of this authorization bypass.