CVE-2026-55499: Cloudreve incorrect authorization in file event stream metadata leakage

CVE-2026-55499 · Severity: medium · CVSS 4.3 · Published 2026-07-31

Cloudreve, a self-hosted file management and sharing system, contains a flaw in how it handles notifications for shared files. When a user is granted access to a single specific file, the system mistakenly subscribes them to activity updates for the entire folder containing that file. While an attacker cannot see the actual contents of other files, they can monitor the names, paths, and modification history of private files belonging to the owner that were never intended to be shared.

Technologies: Cloudreve, github.com/cloudreve/Cloudreve (Go), github.com/cloudreve/Cloudreve/v3 (Go), github.com/cloudreve/Cloudreve/v4 (Go). Vendors: Cloudreve, Go.

Quick answers

Is CVE-2026-55499 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55499 being exploited in the wild.
How severe is CVE-2026-55499?
Medium severity, with a CVSS score of 4.3, published 31 July 2026.
Which products and versions are affected?
Cloudreve < 4.17.0, <= 3.0.0-20250225100611-da4e44b77af4; github.com/cloudreve/Cloudreve (Go) SEMVER:introduced=0; github.com/cloudreve/Cloudreve/v3 (Go) <= 3.0.0-20250225100611-da4e44b77af4, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=3.0.0-20250225100611-da4e44b77af4; github.com/cloudreve/Cloudreve/v4 (Go) < 4.0.0-20260613030215-0b00dd308f13, SEMVER:introduced=0,fixed=4.0.0-20260613030215-0b00dd308f13.
Is there a fix for CVE-2026-55499?
Yes. github.com/cloudreve/Cloudreve/v4 (Go): upgrade to 4.0.0-20260613030215-0b00dd308f13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55499 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-55499?
Check whether you run Cloudreve, github.com/cloudreve/Cloudreve (Go), github.com/cloudreve/Cloudreve/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/cloudreve/Cloudreve/v4 (Go): upgrade to 4.0.0-20260613030215-0b00dd308f13 or later
    go get github.com/cloudreve/Cloudreve/v4@v4.0.0-20260613030215-0b00dd308f13

Technical details

The vulnerability exists in the Server-Sent Events (SSE) implementation within `service/explorer/events.go`. When a recipient accesses the event stream for a single-file share, the `share_navigator` resolves the root URI to the owner's parent folder rather than the specific shared file. The event hub then subscribes the user to the parent folder's ID. Because the publication logic only filters out the client ID that triggered the event and does not verify the subscriber's specific share scope, the recipient receives real-time metadata (names, paths, rename targets, and hashed identifiers) for all sibling files in that directory. This is fixed in version 4.17.0 by blocking subscriptions to single-file share roots.

Affected products

  • Cloudreve Cloudreve < 4.17.0

Identifiers

  • CVE-2026-55499
  • GHSA-w8x7-h2px-xmq8
  • GO-2026-6102

Timeline

  • 2026-06-26: patched: Version 4.17.0 released
  • 2026-07-23: advisory: GitHub Security Advisory published
  • 2026-07-31: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.