CVE-2026-55499
MEDIUMCloudreve: Broken access control in file event stream leaks activity events for unshared siblings to single-file share recipients
Title source: cnaDescription
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, a single-file share event-stream subscription resolves the share root to the owner’s parent folder and subscribes to that folder topic, allowing an authenticated share recipient to receive names, paths, rename targets, event types, and hashed identifiers for unshared sibling files and folders. This issue is fixed in version 4.17.0.
References (3)
Core 3
Core References
X_Refsource_Confirm x_refsource_confirm
https://github.com/cloudreve/cloudreve/security/advisories/GHSA-w8x7-h2px-xmq8
X_Refsource_Misc x_refsource_misc
https://github.com/cloudreve/cloudreve/commit/0b00dd308f132d6e6e8476857ef79f4865600bbc
X_Refsource_Misc x_refsource_misc
https://github.com/cloudreve/cloudreve/releases/tag/4.17.0
Scores
CVSS v3
4.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Details
CWE
CWE-863
Status
published
Products (1)
cloudreve/cloudreve
< 4.17.0
Published
Jul 31, 2026
Tracked Since
Jul 31, 2026