Vulnerability · Published Sep 27, 2026 · Assigned by VulnCheck
CVE-2026-101056Cloudreve before 4.16.1 Authentication Bypass via Cached Context Hint
Medium 5.3
In plain English
A medium-severity incorrect authorization in cloudreve from cloudreve. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.2%top 90.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a context_hint UUID. Attackers who previously had valid share access can replay the cached hint to generate signed file URLs for up to 300 seconds after the share is deleted, expires, or reaches zero remaining downloads.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/cloudreve/Cloudreve | no fix listed | GO-2026-6287 |
| Go | github.com/cloudreve/Cloudreve/v3 | no fix listed | GO-2026-6287 |
| Go | github.com/cloudreve/Cloudreve/v4 | no fix listed | GHSA-vx2m-jpxr-xv7w |
| Go | github.com/cloudreve/Cloudreve/v4 | no fix listed | GO-2026-6287 |
Affected products (as reported)
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- GitHub Security Advisory (GHSA-vx2m-jpxr-xv7w) vendor-advisory
- VulnCheck Advisory: Cloudreve before 4.16.1 Authentication Bypass via Cached Context Hint third-party-advisory