# CVE-2026-101056: Cloudreve access control bypass in share validation

Source: https://junglewise.ai/threats/cve-2026-101056-cloudreve-before-4-16-1-fails-to-revalidate-share-access-when  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-27. Updated: 2026-09-27  
License: CC BY 4.0 with a link back

CVE-2026-101056 · Severity: medium · CVSS 5.3 · Published 2026-09-27

Cloudreve is a self-hosted cloud storage platform. When a user shares files with others, the system caches access information using a UUID hint. If an attacker previously had valid access to a share, they can replay this cached hint to download files for up to 5 minutes after the share owner deletes it, blocks it from expiring, or runs out of allowed downloads. This allows unauthorized file access even after the share is supposed to be revoked.

Technologies: [Cloudreve](https://junglewise.ai/threats/technologies/cloudreve). Vendors: [Cloudreve](https://junglewise.ai/threats/vendors/cloudreve).

## Quick answers

**Is CVE-2026-101056 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-101056 being exploited in the wild.

**How severe is CVE-2026-101056?** Medium severity, with a CVSS score of 5.3, published 27 September 2026.

**Which products and versions are affected?** Cloudreve before 4.16.1.

**Is there a fix for CVE-2026-101056?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-101056 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-101056?** Check whether you run Cloudreve at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a broken access control issue where the file/url and file/thumb routes accept a client-supplied context_hint UUID that restores cached navigator state without re-validating share access. The shareNavigator.RestoreState function restores the cached shareRoot, which causes the To() function to skip the Root() revalidation that checks share expiry, download limits, and password; an attacker who previously warmed the cache with a valid hint can replay it within the 300-second context-hint TTL to mint signed file URLs after revocation. The attack requires prior knowledge of the shared file paths and prior valid access to the share.

## Affected products

- Cloudreve Cloudreve before 4.16.1

## Timeline

- 2026-09-27: disclosed: Published on NVD and GitHub Security Advisory (GHSA-vx2m-jpxr-xv7w)

## References

- [https://github.com/cloudreve/cloudreve/security/advisories/GHSA-vx2m-jpxr-xv7w](https://github.com/cloudreve/cloudreve/security/advisories/GHSA-vx2m-jpxr-xv7w)
- [https://www.vulncheck.com/advisories/cloudreve-before-4.16.1-authentication-bypass-via-cached-context-hint](https://www.vulncheck.com/advisories/cloudreve-before-4.16.1-authentication-bypass-via-cached-context-hint)

## Related threats

- [Cloudreve authorization bypass in admin node test endpoints](https://junglewise.ai/threats/cve-2026-101048-cloudreve-before-4-17-0-registers-the-administrative-node-test)
- [Cloudreve SSRF guard bypass via IPv6 transition wrappers](https://junglewise.ai/threats/cve-2026-79913-cloudreve-ssrf-guard-bypass-via-ipv6-transition-wrappers)
- [Cloudreve privilege scope bypass in admin API endpoints](https://junglewise.ai/threats/cve-2026-77637-cloudreve-privilege-scope-bypass-in-admin-api-endpoints)
- [Cloudreve TOCTOU race in storage-quota check and charge](https://junglewise.ai/threats/cve-2026-77633-cloudreve-toctou-race-in-storage-quota-check-and-charge)
- [Cloudreve broken access control in file share caching](https://junglewise.ai/threats/cloudreve-broken-access-control-in-file-share-caching-13df24a4)