Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 5.3, published 24 August 2026.

Which products and versions are affected?

Cloudreve <= 4.0.0-20260606032813-26b6b1044b02; github.com/cloudreve/Cloudreve/v4 (Go) <= 4.0.0-20260606032813-26b6b1044b02.

Is there a fix for This vulnerability?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is This vulnerability attacked?

It is attacked over the network, in a web application.

Check whether you run Cloudreve or github.com/cloudreve/Cloudreve/v4 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Cloudreve broken access control in file share caching

Q: Which products and versions are affected?

Cloudreve <= 4.0.0-20260606032813-26b6b1044b02; github.com/cloudreve/Cloudreve/v4 (Go) <= 4.0.0-20260606032813-26b6b1044b02.

Q: Is there a fix for This vulnerability?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is This vulnerability attacked?

It is attacked over the network, in a web application.

Q: Am I affected?

Check whether you run Cloudreve or github.com/cloudreve/Cloudreve/v4 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: medium · CVSS 5.3 · Published 2026-08-24

Cloudreve is a self-hosted file management and sharing platform. A former file-share recipient can generate signed download URLs for files they previously had access to for up to 5 minutes after the share is deleted or expires, bypassing the owner's revocation decision and download limits. An attacker must have already seen the files during a valid share and obtained the share hint.

Technologies: Cloudreve, github.com/cloudreve/Cloudreve/v4 (Go). Vendors: Cloudreve, Go.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 5.3, published 24 August 2026.
Which products and versions are affected?: Cloudreve <= 4.0.0-20260606032813-26b6b1044b02; github.com/cloudreve/Cloudreve/v4 (Go) <= 4.0.0-20260606032813-26b6b1044b02.
Is there a fix for This vulnerability?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is This vulnerability attacked?: It is attacked over the network, in a web application.
Am I affected?: Check whether you run Cloudreve or github.com/cloudreve/Cloudreve/v4 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a broken access control (CWE-863) in the share-caching mechanism. The root cause spans multiple components: (1) file-listing responses return a `context_hint` (UUID) and file paths to the client; (2) the `file/url` and `file/thumb` routes accept this hint via the `X-Cr-Context-Hint` header without independent share re-validation; (3) DBFS caches `shareNavigatorState` (containing `shareRoot` and `share` row) for 300 seconds under the hint; (4) on cache hit, `shareNavigator.RestoreState` restores cached state, and `shareNavigator.To` skips calling `Root()`, which is the sole place that re-checks `inventory.IsValidShare` (expiry, download limits, owner status, source-file validity) and password; (5) failed download hooks are only logged and do not block URL generation; (6) signed content endpoints validate only the signature, not share state. An attacker who is a former recipient must pre-warm the hint cache while a share is valid, then after the owner deletes the share or it expires, can replay the cached hint within 300 seconds to obtain signed download URLs without re-authorization. Exploitation requires prior knowledge of the target file URI from a valid share listing.

Affected products

cloudreve Cloudreve <= 4.0.0-20260606032813-26b6b1044b02

Timeline

2026-08-24: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.