CVE-2026-50891: Incorrect access control in the /admin/api/config component of Filestash v0

Synopsis

An incorrect access control vulnerability in the /admin/api/config endpoint of Filestash v0.4.0 allows an authenticated attacker to escalate their privileges by sending a crafted HTTP request to the admin API. The vulnerability is reachable over the network and requires only a low-privilege account, meaning no admin credentials are needed to begin the attack. Successful exploitation gives the attacker both read and write access to application configuration, effectively granting administrative control. HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable /admin/api/config endpoint is exposed over the network, so an attacker must be able to reach the service via HTTP/HTTPS to exploit it.

• AuthenticationRequired

  A valid account is required to send requests, but any low-privilege account is sufficient; no administrator credentials are needed.

• Victim interactionNot required

  The attacker sends a crafted request directly to the endpoint; no action from another user is needed to trigger the vulnerability.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, memory layout dependencies, or other environmental factors need to align.

Blast Radius

• A successful attacker reads the full application configuration via the admin API, which may expose credentials, storage backend secrets, and integration tokens stored in that configuration.
• The attacker can write arbitrary configuration values, allowing them to redirect storage backends, disable authentication requirements, or alter access control rules across the Filestash instance.
• Privilege escalation to effective administrative control means any data managed through the Filestash instance is accessible and modifiable by the attacker.