CVE-2026-62684

Summary When a user creates a password-protected share or lists existing shares, the JSON response includes the full bcrypt password_hash and the secret token of the share. The Link storage struct is serialized directly with json.Marshal and tags password_hash and token for output, with no field filtering. Any authenticated user receives these secrets for their own shares, and an administrator listing all shares via GET /api/shares receives the password hash and bypass token for every user's shares, enabling offline cracking of share passwords and direct password-bypass access to protected shares. Details 1. The Link struct serializes both secrets to JSON (share/share.go:10-19) type Link struct { Hash string json:"hash" storm:"id,index" Path string json:"path" storm:"index" UserID uint json:"userID" Expire int64 json:"expire" PasswordHash string json:"password_hash,omitempty" // line 15, bcrypt hash exposed // Token is only set when PasswordHash is set; it bypasses the password. Token string json:"token,omitempty" // line 19, bypass token exposed } omitempty means the hash and token are emitted whenever a share is password-protected, i.e. in every response for such a share. 2. The share handlers return the full struct through unfiltered json.Marshal sharePostHandler returns the created Link with renderJSON(w, r, s) (http/share.go:179); shareListHandler and shareGetsHandler return shares the same way (http/share.go:55, http/share.go:76). renderJSON performs an unfiltered json.Marshal(data) (http/utils.go:16), so every tagged field, including password_hash and token, reaches the client. 3. Administrators receive every user's secrets (http/share.go:36) s, err = d.store.Share.All() // admin path: returns ALL users' shares // ... return renderJSON(w, r, s) // including each share's password_hash and token An admin calling GET /api/shares receives the bcrypt hash and bypass token for all shares across all users. PoC Tested against filebrowser/filebrowser:v2.63

[![CVE-2026-62684 status](https://www.csirts.com/badge/CVE-2026-62684)](https://www.csirts.com/cve/CVE-2026-62684)