CVE-2026-44460
Published: 27 May 2026
Summary
CVE-2026-44460 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-32584
Vulnerability details
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.12.0, /api/totp_setup.php is callable from a session that has only passed the password check (state pending_login_user). When the target account already has TOTP configured,…
more
the endpoint decrypts and returns the user's existing TOTP secret inside the QR PNG instead of refusing or generating a new secret. An attacker who already possesses the victim's password can therefore retrieve the live TOTP secret, derive a valid one-time code, submit it to /api/totp_verify.php, and obtain a fully authenticated session without ever possessing the victim's authenticator device. This vulnerability is fixed in 3.12.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in public-facing web endpoint directly enables authentication bypass after password check by exposing TOTP secret.
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Session auditing enables detection of unauthorized exposure or access to sensitive information during user activities.
Security architectures must specify authentication requirements and approaches, making systemic authentication weaknesses harder to introduce.
Assessment of authentication-related threats and vulnerabilities leads to remediation of missing or weak authentication controls.
Decoys supply misleading data and log access attempts, directly detecting and deflecting unauthorized information exposure.
Literacy training teaches users to recognize and avoid actions that result in unauthorized exposure of sensitive information.
Audit record review and analysis can detect unauthorized exposure or access to sensitive information.
Assessments check authentication mechanisms for correct implementation and effectiveness, reducing successful authentication bypass attempts.
Penetration testing probes authentication mechanisms for bypasses, allowing identification and fixing of improper authentication issues.