What is CVE-2026-69193?

CVE-2026-69193 is a medium-severity vulnerability in Error311 Filerise, classified under Improper Restriction of Excessive Authentication Attempts. CVSS score: 6.5/10. Published 2026-10-14.

How severe is CVE-2026-69193?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Error311 Filerise

CVE-2026-69193

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.21.0, FileRise tracks failed logins only by the combination of source IP address and username. A remote unauthenticated attacker can rotate usernames to obtain a fresh per-account attempt budget for each name, enabling password spraying from one source beyond the intended limit. Per-user limits still apply and can also produce distinguishable throttling behavior for targeted accounts. The affected surface is AuthModel::getFailedLoginKey(). This issue is fixed in version 3.21.0.

Published 2026-10-14 · last modified 2026-10-15.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Error311 Filerise — versions < 3.21.0

Weakness classification (CWE)

CWE-307 — Improper Restriction of Excessive Authentication Attempts

References

Frequently asked questions

What is CVE-2026-69193?: CVE-2026-69193 is a medium-severity vulnerability in Error311 Filerise, classified under Improper Restriction of Excessive Authentication Attempts. CVSS score: 6.5/10. Published 2026-10-14.
How severe is CVE-2026-69193?: Medium severity. CVSS v3 base score is 6.5 out of 10.