Read the docs
TI-2026-65089 Aliases CVE-2026-101056GHSA-qh53-mf6v-496j

Cloudreve before 4.16.1 Authentication Bypass via Cached Context Hint

Priority HIGH 70CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a context_hint UUID. Attackers who previously had valid share access can replay the cached hint to generate signed file URLs for up to 300 seconds after the share is deleted, expires, or reaches zero remaining downloads.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00195 9th percentileScored 2026-11-07
Fix Fixed cloudreve (cloudreve): 4.16.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
cloudrevecloudrevebefore 4.16.14.16.1Patch availableCNA
  • cloudreve Vendorcloudreve Affected before 4.16.1 Fixed in 4.16.1 Patch available CNA

Remediation

  • Fix · CNA cloudreve (cloudreve) Fixed in 4.16.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    cloudreve 4.16.1

    2 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM

    Other records, highest priority first

    • TI-2026-65084 Cloudreve before 4.16.1 Path Traversal via Remote DownloadPriority MEDIUM 45
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-101056
  2. 2026-10-03 Alias added: GHSA-qh53-mf6v-496j

References

Advisory 1

  • TI-2026-39397 Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim CVSS 3.1HIGH 7.6
  • TI-2026-40054 Cloudreve: OAuth Admin.Read scope can update OneDrive storage policy credentials CVSS 3.1HIGH 7.1
  • TI-2026-39400 Incorrect authorization in cloudreve CVSS 3.1HIGH 7.1
  • TI-2026-40050 Cloudreve: Server crash through image decompression/pixel bomb in thumbnail & avatar decoding (DoS) CVSS 3.1MEDIUM 6.5
  • TI-2026-39399 Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses CVSS 3.1MEDIUM 6.5
  • TI-2026-44495 Cloudreve: Unauthorized file write via WOPI view sessions whose access token secret is ignored CVSS 3.1MEDIUM 6.3
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences