CVE-2026-72837 reveals that File Browser's user directory isolation feature (createUserDir) works correctly for direct authentication but is entirely bypassed when users authenticate through proxy or hook handlers. The practical impact: an attacker with valid proxy-authenticated credentials can access files outside their designated directory, potentially reaching files owned by other users or the server root itself.
The deeper problem isn't the bypass itself — it's why the bypass exists. The proxy and hook authentication paths don't simply omit the isolation logic; they receive a positive grant of server-root filesystem scope that direct authentication explicitly does not get. This wasn't an oversight. It reflects an original design assumption that proxy-authenticated users occupy a privileged operational tier where isolation is intentionally disabled, likely because the upstream auth provider was expected to handle user separation. The createUserDir feature was added later and backfitted to the standard auth path, but the privileged proxy tier was never audited against the new security model.
This architectural pattern — security bolted onto one auth path but absent from another — creates a cognitive load problem. Any developer implementing a new proxy or hook authenticator receives no signal from the API that they must initialize user context, apply directory isolation, or scope filesystem permissions. They're told only to return credentials. Isolation becomes an optional step that handler authors must remember to apply, and memory fails.
For defenders, three priorities emerge. First, audit your authentication configuration: if you use proxy or hook authentication, verify whether users are landing in isolated directories or at server root. Second, examine your upstream auth provider's posture — the CVE's impact scales directly with upstream hygiene. A weak SSO, LDAP with shared accounts, or brute-force-vulnerable authentication backend turns this into a privilege escalation vector. Third, review whether the proxy path's privileged scope is actually required for your deployment. If it exists for legacy administrative reasons, treat it as a security-sensitive configuration that warrants explicit justification and documentation.
This CVE follows a recurring lineage — similar bypasses appeared in CVE-2019-7298 and CVE-2021-27972 across comparable file-sharing products. The consistent pattern: a privileged authentication tier assumed upstream trust handled separation, and deployments later proved that assumption false. The patch will close this specific bypass, but the underlying API contract — where authentication handlers receive no explicit security requirements — will produce the next instance of this vulnerability class unless the architecture itself changes.