CVE-2026-101056 in Cloudreve
Summary
by MITRE • 09/27/2026
Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a context_hint UUID. Attackers who previously had valid share access can replay the cached hint to generate signed file URLs for up to 300 seconds after the share is deleted, expires, or reaches zero remaining downloads.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/27/2026
The vulnerability identified in Cloudreve versions prior to 4.16.1 represents a critical flaw in session management and access control validation mechanisms, specifically concerning how cached navigation states interact with file sharing permissions. This issue stems from an improper revalidation of share access rights when the application restores navigator state using a context_hint UUID. In typical web applications, particularly those handling sensitive data like cloud storage services, it is imperative that every request for protected resources undergoes real-time verification against current authorization policies. However, in this specific implementation, the system relies on cached hints to reconstruct user sessions or navigation contexts without sufficiently checking whether the underlying share permissions have been revoked, expired, or exhausted during the interval between caching and subsequent access attempts. This architectural oversight creates a window of opportunity where stale authentication tokens or state identifiers retain their efficacy beyond their intended lifespan.
From a technical perspective, the core flaw lies in the asynchronous nature of cache restoration versus synchronous permission checks. When a user previously had valid access to a shared file or directory, Cloudreve generates signed URLs and caches certain navigational hints associated with that session. These hints are designed to improve performance by reducing redundant database queries for active sessions. However, the system fails to implement a robust revocation check mechanism when these cached states are restored via the context_hint UUID parameter. Consequently, if an attacker or any user retains knowledge of this hint after the share has been deleted, expired due to time limits, or reached its maximum download count limit, they can replay this cached state to generate valid signed file URLs. The system incorrectly assumes that a previously issued and cached hint remains valid for subsequent requests within a short timeframe, ignoring the dynamic nature of access control lists associated with shared resources.
The operational impact of this vulnerability is significant, allowing unauthorized users to maintain access to sensitive files long after they should have been denied entry. Specifically, attackers can exploit this race condition or state inconsistency to generate signed file URLs for up to 300 seconds after the share has become invalid. While three hundred seconds may seem brief, it provides a sufficient window for automated scripts or determined adversaries to download large volumes of data before the system eventually catches up with its permission updates. This leads to potential data leakage, loss of confidentiality, and violation of access control policies. For organizations relying on Cloudreve for secure file sharing, this means that revoking share links does not immediately terminate access, undermining trust in the platform's security model and potentially exposing proprietary or personal information to unauthorized parties.
This vulnerability aligns with several established industry standards regarding web application security flaws. It is primarily classified under CWE-613, which denotes Insufficient Session Expiration, as the system fails to properly invalidate session-related data upon revocation of access rights. Additionally, it falls under CWE-284, Improper Access Control, because the application does not enforce proper restrictions on authenticated users' ability to perform unauthorized actions or access restricted resources based on current authorization states. In terms of offensive security frameworks such as MITRE ATT&CK for Enterprise, this behavior facilitates techniques related to Credential Replay and Persistence through cached state manipulation, allowing adversaries to maintain footholds in systems even after initial detection or remediation attempts have been initiated by administrators.
To mitigate this vulnerability, immediate upgrades to Cloudreve version 4.16.1 or later are required, as the developers have addressed these issues in subsequent releases. In addition to upgrading, system administrators should implement strict cache invalidation policies that ensure any cached navigator states or session hints are immediately purged when a share is deleted, expires, or reaches its download limit. It is also advisable to enforce server-side validation for every request involving shared resources, ensuring that the current state of the share permission is checked in real-time rather than relying solely on client-side caches or previously issued tokens. Implementing short-lived signed URLs with strict expiration times and verifying these signatures against a central authorization service can further reduce the risk window. Regular security audits focusing on session management and access control logic are recommended to identify similar patterns of improper state validation across other modules within the application infrastructure.