CVE-2026-55499

Published: Jul 31, 2026Modified: Sep 8, 2026Deferred

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, a single-file share event-stream subscription resolves the share root to the owner’s parent folder and subscribes to that folder topic, allowing an authenticated share recipient to receive names, paths, rename targets, event types, and hashed identifiers for unshared sibling files and folders. This issue is fixed in version 4.17.0.

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (4)

https://github.com/cloudreve/cloudreve/commit/0b00dd308f132d6e6e8476857ef79f4865600bbc

Source: security-advisories@github.com

https://github.com/cloudreve/cloudreve/releases/tag/4.17.0

Source: security-advisories@github.com

https://github.com/cloudreve/cloudreve/security/advisories/GHSA-w8x7-h2px-xmq8

Source: security-advisories@github.com

https://github.com/cloudreve/cloudreve/security/advisories/GHSA-w8x7-h2px-xmq8

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.