CVE-2026-50891: Filestash v0.4.0 Privilege Escalation via /admin/api/config Access Control Bypass

Technical summary

CVE-2026-50891 is a privilege escalation vulnerability stemming from improper access control implementation (CWE-284) in Filestash v0.4.0's /admin/api/config component. The vulnerability requires an authenticated session (PR:L in the CVSS vector) but does not require user interaction. An attacker can bypass authorization checks by sending a crafted API request, achieving high-impact confidentiality and integrity violations without affecting system availability. The CVSS 3.1 score of 8.1 reflects the network-accessible nature and low attack complexity of the exploit.

Business impact

This vulnerability enables lateral movement and privilege escalation for any user with Filestash credentials. Attackers could reconfigure authentication settings, modify user permissions, or access sensitive files stored within Filestash. Organizations relying on Filestash for document management or file sharing face risks to data confidentiality, unauthorized modifications to critical settings, and potential compliance violations if sensitive data is exposed. The impact is magnified in environments where Filestash handles regulated content (PII, healthcare records, financial data).

Affected systems

Filestash v0.4.0 is confirmed vulnerable. Organizations should verify whether they are running this specific version. Filestash administrators should check deployment logs and asset inventories to identify affected instances. Users of earlier or later versions should consult the vendor advisory to confirm whether their versions are in scope.

Exploitability

Exploitation is straightforward for attackers who have obtained valid user credentials (either through phishing, password reuse, or compromised accounts). No sophisticated techniques, special tools, or zero-day exploits are required—the attack is a simple crafted HTTP request to a known endpoint. The lack of user interaction requirement and network accessibility make this practical to exploit at scale if credentials are compromised. However, the requirement for initial authentication (PR:L) prevents unauthenticated exploitation.

Remediation

Upgrade Filestash to a patched version that addresses the authorization bypass in the /admin/api/config component. Consult the official Filestash security advisories for the minimum patched version. Until patching is possible, restrict network access to the Filestash admin API using firewall rules or network segmentation, and enforce strong, unique passwords and multi-factor authentication to reduce credential compromise risk.

Patch guidance

Contact Filestash maintainers or visit the official project repository for security updates. Verify the patched version number against the vendor advisory before deployment. Test patches in a staging environment to confirm compatibility with your Filestash configuration and any dependent systems. Plan patching around maintenance windows to minimize service disruption. Monitor deployment logs to confirm successful application of the fix across all Filestash instances.

Detection guidance

Monitor HTTP POST/PUT requests to /admin/api/config endpoints for suspicious patterns, such as requests from unexpected source IPs or during unusual hours. Log authentication events and track privilege escalation attempts. Use Web Application Firewalls (WAF) to inspect request payloads for known malicious signatures. Audit Filestash configuration changes and user permission modifications against a baseline to identify unauthorized alterations. Review access logs for any unauthenticated or unprivileged users accessing admin endpoints.

Why prioritize this

This vulnerability merits urgent attention due to its HIGH severity (CVSS 8.1), low attack complexity, and immediate impact on data confidentiality and integrity. Although exploitation requires prior authentication, the ease of crafting the malicious request and the sensitivity of admin configuration access make this a top remediation priority. Organizations should patch or mitigate this vulnerability within days, not weeks.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects: network accessibility (AV:N) allowing remote exploitation, low attack complexity (AC:L) requiring no special conditions, authenticated attacker requirement (PR:L) that limits scope to users with credentials, high confidentiality impact (C:H) via unauthorized access to admin settings, and high integrity impact (I:H) via unauthorized configuration changes. The absence of availability impact (A:N) prevents a critical rating.

Frequently asked questions