Executive brief
Cloudreve, a self-hosted file management and sharing system, contains a vulnerability that allows any logged-in user to search for and view the email addresses of inactive or banned accounts. While these accounts are intended to be hidden from the public directory, a flaw in the search function fails to filter them out. This could lead to the exposure of private user information and the enumeration of the platform's user base, potentially impacting user privacy and reputation.
Technical details
The vulnerability exists in the 'GET /api/v4/user/search' endpoint, which invokes the 'SearchActive' method in 'inventory/user.go'. Despite its name, 'SearchActive' lacks a 'StatusActive' predicate in its database query, filtering only by email or nickname keywords. Furthermore, search results are serialized at 'RedactLevelUser', which explicitly includes the user's email address. Because the system lacks a global status interceptor for the User model (only supporting soft-delete), inactive and banned accounts are returned to any authenticated caller. An attacker with a standard user account can provide a 2-character keyword to harvest PII (emails, nicknames, and group metadata) of accounts that should be restricted. This issue is resolved in version 4.17.0 by adding the 'StatusEQ' check to the search query.
Affected products
- cloudreve Cloudreve < 4.17.0
Timeline
- 2026-06-26: patched: Version 4.17.0 released
- 2026-07-23: advisory: GitHub Security Advisory published
- 2026-07-31: disclosed: CVE published to NVD