The CVSS 9.8 rating for CVE-2026-72839 is technically accurate but misleading if it leads you to treat this as a straightforward authentication bypass. It isn't. The vulnerability requires self-signup to be deliberately enabled by an administrator — a configuration choice, not a default — and hinges on how filebrowser's CreateUserDir setting interacts with new user registration. When enabled (the default), newly registered users inherit server-root scope rather than being isolated to their own storage directory. The attacker isn't bypassing authentication; they're registering an account exactly as designed, while the permission model catastrophically fails to enforce scope boundaries.
The EPSS score of 0.00394 reflects the narrow prerequisites rather than low impact. An instance is vulnerable only if self-signup is enabled AND accessible to unauthenticated users AND an attacker can successfully register. Each condition narrows the attack surface. However, this constraint is temporal, not permanent — as the CVE ages, more scanners will fingerprint this pattern and more exploit frameworks will package the registration-to-root path.
What matters practically: check whether CreateUserDir is enabled on your instance, regardless of other settings. The secure default debate (code vulnerability vs. deployment vulnerability) is interesting but secondary to the core question: does the fix actually enforce scope boundaries in code, or merely disable the CreateUserDir default? The former is a genuine security fix; the latter leaves the underlying permission model broken while making the attack path harder to discover.
The blast radius extends beyond filebrowser itself. This software frequently runs alongside backup systems, container orchestration, CI/CD pipelines, and secrets management on developer workstations and homelab infrastructure. Server-root scope inheritance means access to TLS certificates, environment variables, systemd units, and cron jobs — the CVSS measures direct impact but not the second-order cascade into adjacent services.
Prioritize: verify CreateUserDir configuration now, disable self-signup if not required, and confirm the patch enforces scope logic rather than merely hiding the dangerous path.