CyberRota Analysis
AI-GeneratedThe vulnerability affects Oracle's filebrowser prior to version 2.63.19, allowing authenticated users with restricted download permissions to bypass access controls via the /api/resources endpoint. This flaw enables the retrieval of content hashes for files, facilitating content verification and potential brute-force attacks on low-entropy files. Organizations using affected versions should prioritize patching to mitigate risks associated with unauthorized data access and integrity checks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum (?checksum=) branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check (unlike the sibling raw, preview, and subtitle paths). As a result, an authenticated user provisioned with Perm.Download=false can obtain a content-hash oracle for any same-scope file (md5/sha1/sha256/sha512), enabling confirmation of known/guessed content, change detection, and offline brute-force of low-entropy files. This is an incomplete fix of CVE-2026-35606; it bypasses only the Download permission and does not defeat scope/path authorization.