Read the docs
TI-2026-40049 Aliases CVE-2026-55496GHSA-8r7f-r8hj-r3rv

Information disclosure in cloudreve

Priority MEDIUM 53CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, GET /api/v4/user/search calls SearchActive without adding a StatusActive predicate and serializes matches at RedactLevelUser, allowing any logged-in user to enumerate email addresses and profile metadata for inactive or banned accounts. The service calls userClient.SearchActive, but despite its name that method filters only by email/nickname keyword and never adds a StatusActive predicate — while the sibling lookups GetActiveByID and GetActiveByDavAccount, defined a few lines above it, do. Search hits are serialized at RedactLevelUser, which includes the email address. This issue is fixed in version 4.17.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00361 30th percentileScored 2026-11-07
Fix Fixed github.com/cloudreve/Cloudreve/v4 (Go): 4.0.0-20260613023921-7e1289d55279

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
cloudrevecloudreve4.17.0—No fix listedCNA
—github.com/cloudreve/Cloudreve/v4 (Go)before 4.0.0-20260613023921-7e1289d552794.0.0-20260613023921-7e1289d55279Patch availableGHSA-8r7f-r8hj-r3rv
—github.com/cloudreve/Cloudreve/v3 (Go)up to 3.0.0-20250225100611-da4e44b77af4—No fix listedGHSA-8r7f-r8hj-r3rv
  • cloudreve Vendorcloudreve Affected 4.17.0 Fixed in — No fix listed CNA
  • github.com/cloudreve/Cloudreve/v4 (Go) Vendor— Affected before 4.0.0-20260613023921-7e1289d55279 Fixed in 4.0.0-20260613023921-7e1289d55279 Patch available GHSA-8r7f-r8hj-r3rv
  • github.com/cloudreve/Cloudreve/v3 (Go) Vendor— Affected up to 3.0.0-20250225100611-da4e44b77af4 Fixed in — No fix listed GHSA-8r7f-r8hj-r3rv

Remediation

  • Fix · GHSA-8r7f-r8hj-r3rv github.com/cloudreve/Cloudreve/v4 (Go) Fixed in 4.0.0-20260613023921-7e1289d55279 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55496
  2. 2026-10-03 Alias added: GHSA-8r7f-r8hj-r3rv

References

Other 4

  • TI-2026-65089 Cloudreve before 4.16.1 Authentication Bypass via Cached Context Hint CVSS 4.0MEDIUM 6.9
  • TI-2026-39397 Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim CVSS 3.1HIGH 7.6
  • TI-2026-40054 Cloudreve: OAuth Admin.Read scope can update OneDrive storage policy credentials CVSS 3.1HIGH 7.1
  • TI-2026-39400 Incorrect authorization in cloudreve CVSS 3.1HIGH 7.1
  • TI-2026-40050 Cloudreve: Server crash through image decompression/pixel bomb in thumbnail & avatar decoding (DoS) CVSS 3.1MEDIUM 6.5
  • TI-2026-39399 Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses CVSS 3.1MEDIUM 6.5
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences