CVE-2026-55496: Cloudreve Information Exposure in User Search API

CVE-2026-55496 · Severity: medium · CVSS 4.3 · Published 2026-07-31

Cloudreve, a self-hosted file management and sharing system, contains a vulnerability that allows any logged-in user to search for and view the email addresses of inactive or banned accounts. While these accounts are intended to be hidden from the public directory, a flaw in the search function fails to filter them out. This could lead to the exposure of private user information and the enumeration of the platform's user base, potentially impacting user privacy and reputation.

Technologies: Cloudreve, github.com/cloudreve/Cloudreve (Go), github.com/cloudreve/Cloudreve/v3 (Go), github.com/cloudreve/Cloudreve/v4 (Go). Vendors: Cloudreve, Go.

Quick answers

Is CVE-2026-55496 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55496 being exploited in the wild.
How severe is CVE-2026-55496?
Medium severity, with a CVSS score of 4.3, published 31 July 2026.
Which products and versions are affected?
Cloudreve < 4.17.0, <= 3.0.0-20250225100611-da4e44b77af4; github.com/cloudreve/Cloudreve (Go) SEMVER:introduced=0; github.com/cloudreve/Cloudreve/v3 (Go) <= 3.0.0-20250225100611-da4e44b77af4, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=3.0.0-20250225100611-da4e44b77af4; github.com/cloudreve/Cloudreve/v4 (Go) < 4.0.0-20260613023921-7e1289d55279, SEMVER:introduced=0,fixed=4.0.0-20260613023921-7e1289d55279.
Is there a fix for CVE-2026-55496?
Yes. github.com/cloudreve/Cloudreve/v4 (Go): upgrade to 4.0.0-20260613023921-7e1289d55279 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55496 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-55496?
Check whether you run Cloudreve, github.com/cloudreve/Cloudreve (Go), github.com/cloudreve/Cloudreve/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/cloudreve/Cloudreve/v4 (Go): upgrade to 4.0.0-20260613023921-7e1289d55279 or later
    go get github.com/cloudreve/Cloudreve/v4@v4.0.0-20260613023921-7e1289d55279

Technical details

The vulnerability exists in the 'GET /api/v4/user/search' endpoint, which invokes the 'SearchActive' method in 'inventory/user.go'. Despite its name, 'SearchActive' lacks a 'StatusActive' predicate in its database query, filtering only by email or nickname keywords. Furthermore, search results are serialized at 'RedactLevelUser', which explicitly includes the user's email address. Because the system lacks a global status interceptor for the User model (only supporting soft-delete), inactive and banned accounts are returned to any authenticated caller. An attacker with a standard user account can provide a 2-character keyword to harvest PII (emails, nicknames, and group metadata) of accounts that should be restricted. This issue is resolved in version 4.17.0 by adding the 'StatusEQ' check to the search query.

Affected products

  • cloudreve Cloudreve < 4.17.0

Identifiers

  • CVE-2026-55496
  • GHSA-8r7f-r8hj-r3rv
  • GO-2026-6098

Timeline

  • 2026-06-26: patched: Version 4.17.0 released
  • 2026-07-23: advisory: GitHub Security Advisory published
  • 2026-07-31: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.