# CVE-2026-55499: Cloudreve incorrect authorization in file event stream metadata leakage

Source: https://junglewise.ai/threats/cve-2026-55499-cloudreve-incorrect-authorization-in-file-event-stream-metadata  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-31. Updated: 2026-07-31  
License: CC BY 4.0 with a link back

CVE-2026-55499 · Severity: medium · CVSS 4.3 · Published 2026-07-31

Cloudreve, a self-hosted file management and sharing system, contains a flaw in how it handles notifications for shared files. When a user is granted access to a single specific file, the system mistakenly subscribes them to activity updates for the entire folder containing that file. While an attacker cannot see the actual contents of other files, they can monitor the names, paths, and modification history of private files belonging to the owner that were never intended to be shared.

Technologies: [Cloudreve](https://junglewise.ai/threats/technologies/cloudreve), [github.com/cloudreve/Cloudreve (Go)](https://junglewise.ai/threats/technologies/github-com-cloudreve-cloudreve), [github.com/cloudreve/Cloudreve/v3 (Go)](https://junglewise.ai/threats/technologies/github-com-cloudreve-cloudreve-v3), [github.com/cloudreve/Cloudreve/v4 (Go)](https://junglewise.ai/threats/technologies/github-com-cloudreve-cloudreve-v4). Vendors: [Cloudreve](https://junglewise.ai/threats/vendors/cloudreve), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-55499 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55499 being exploited in the wild.

**How severe is CVE-2026-55499?** Medium severity, with a CVSS score of 4.3, published 31 July 2026.

**Which products and versions are affected?** Cloudreve < 4.17.0, <= 3.0.0-20250225100611-da4e44b77af4; github.com/cloudreve/Cloudreve (Go) SEMVER:introduced=0; github.com/cloudreve/Cloudreve/v3 (Go) <= 3.0.0-20250225100611-da4e44b77af4, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=3.0.0-20250225100611-da4e44b77af4; github.com/cloudreve/Cloudreve/v4 (Go) < 4.0.0-20260613030215-0b00dd308f13, SEMVER:introduced=0,fixed=4.0.0-20260613030215-0b00dd308f13.

**Is there a fix for CVE-2026-55499?** Yes. github.com/cloudreve/Cloudreve/v4 (Go): upgrade to 4.0.0-20260613030215-0b00dd308f13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55499 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-55499?** Check whether you run Cloudreve, github.com/cloudreve/Cloudreve (Go), github.com/cloudreve/Cloudreve/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/cloudreve/Cloudreve/v4 (Go): upgrade to 4.0.0-20260613030215-0b00dd308f13 or later

  ```sh
  go get github.com/cloudreve/Cloudreve/v4@v4.0.0-20260613030215-0b00dd308f13
  ```


## Technical details

The vulnerability exists in the Server-Sent Events (SSE) implementation within `service/explorer/events.go`. When a recipient accesses the event stream for a single-file share, the `share_navigator` resolves the root URI to the owner's parent folder rather than the specific shared file. The event hub then subscribes the user to the parent folder's ID. Because the publication logic only filters out the client ID that triggered the event and does not verify the subscriber's specific share scope, the recipient receives real-time metadata (names, paths, rename targets, and hashed identifiers) for all sibling files in that directory. This is fixed in version 4.17.0 by blocking subscriptions to single-file share roots.

## Affected products

- Cloudreve Cloudreve < 4.17.0

## Identifiers

- CVE-2026-55499
- GHSA-w8x7-h2px-xmq8
- GO-2026-6102

## Timeline

- 2026-06-26: patched: Version 4.17.0 released
- 2026-07-23: advisory: GitHub Security Advisory published
- 2026-07-31: disclosed: NVD publication date

## References

- [https://github.com/cloudreve/cloudreve/commit/0b00dd308f132d6e6e8476857ef79f4865600bbc](https://github.com/cloudreve/cloudreve/commit/0b00dd308f132d6e6e8476857ef79f4865600bbc)
- [https://github.com/cloudreve/cloudreve/releases/tag/4.17.0](https://github.com/cloudreve/cloudreve/releases/tag/4.17.0)
- [https://github.com/cloudreve/cloudreve/security/advisories/GHSA-w8x7-h2px-xmq8](https://github.com/cloudreve/cloudreve/security/advisories/GHSA-w8x7-h2px-xmq8)

## Related threats

- [Cloudreve access control bypass in share validation](https://junglewise.ai/threats/cve-2026-101056-cloudreve-before-4-16-1-fails-to-revalidate-share-access-when)
- [Cloudreve authorization bypass in admin node test endpoints](https://junglewise.ai/threats/cve-2026-101048-cloudreve-before-4-17-0-registers-the-administrative-node-test)
- [Cloudreve SSRF guard bypass via IPv6 transition wrappers](https://junglewise.ai/threats/cve-2026-79913-cloudreve-ssrf-guard-bypass-via-ipv6-transition-wrappers)
- [Cloudreve privilege scope bypass in admin API endpoints](https://junglewise.ai/threats/cve-2026-77637-cloudreve-privilege-scope-bypass-in-admin-api-endpoints)
- [Cloudreve TOCTOU race in storage-quota check and charge](https://junglewise.ai/threats/cve-2026-77633-cloudreve-toctou-race-in-storage-quota-check-and-charge)