FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and CreateUserDir are enabled and FileBrowser's root is on a case-insensitive filesystem (confirmed on Windows/NTFS), two self-registered usernames that differ only in letter case (e.g., CaseVictim and casevictim) are stored as distinct accounts but resolve to the same physical home directory, because the scope-ownership check compares the persisted scope as an exact case-sensitive string. A second registrant can therefore read, overwrite, and delete another account's files through authenticated HTTP endpoints, without needing an existing account or victim interaction.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
FileBrowser versions before 2.63.19 contain a critical authentication bypass vulnerability affecting self-registration functionality on case-insensitive filesystems like NTFS (Windows). When both Signup and CreateUserDir features are enabled, attackers can register multiple user accounts with usernames differing only in letter case (e.g., "Admin" and "admin"), which the system treats as separate accounts but the operating system resolves to the same physical directory. This bypasses the ownership validation check that should prevent unauthorized directory access, allowing an attacker to gain unauthorized access to other users' home directories and sensitive files. Organizations running FileBrowser on Windows servers or any case-insensitive filesystem with self-registration enabled face direct risk of privilege escalation and lateral movement within their file-sharing infrastructure.
While Casky.ai currently shows zero matching skills for this specific CVE, practitioners using Claude AI with extended reasoning can identify attack indicators by analyzing authentication anomalies and filesystem access patterns. The vulnerability maps conceptually to improper input validation and authorization flaws—practitioners should monitor for suspicious patterns including: multiple user registrations with similar names (case-variation detection), concurrent access to shared directories from different accounts, and failed ownership validation logs during user provisioning. Security teams should configure detection rules around self-registration events on case-insensitive systems, implement strict input normalization (case-standardization) during account creation, and audit existing FileBrowser deployments to identify potentially conflicting case-variant usernames that may already exist in their environment.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-72836. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation