CVE-2026-62323 in Cloudreve
Summary
by MITRE • 07/31/2026
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, ViewerSessionValidation uses only the session-id prefix of a WOPI access token and does not enforce the requested viewer action, allowing a malicious or compromised WOPI viewer with a view session to forge the token suffix and invoke WOPI write routes for the underlying file. This issue is fixed in version 4.17.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/31/2026
The vulnerability identified in Cloudreve versions prior to 4.17.0 represents a critical authorization bypass flaw that undermines the security of the file management system's integration with WOPI (Web-based Office Protocol) viewers. This weakness specifically affects the ViewerSessionValidation mechanism, which is responsible for verifying access permissions when users interact with files through external office viewers. The implementation fails to properly validate the complete WOPI access token by relying solely on the session-id prefix while neglecting to enforce the requested viewer action associated with that token.
The technical flaw stems from insufficient validation logic where the system accepts a WOPI access token based only on its session identifier prefix without verifying whether the token was issued for read-only operations or if it includes write permissions. This incomplete validation creates an opportunity for attackers to manipulate tokens by forging the suffix portion of the WOPI access token, effectively allowing them to escalate their privileges from viewing to editing operations within the file management system. The vulnerability operates under the principle that a valid session-id prefix should not be sufficient to grant full access rights without proper action validation.
From an operational perspective, this vulnerability poses significant risks to organizations relying on Cloudreve for document management and collaboration. A malicious or compromised WOPI viewer could exploit this flaw to invoke write routes through the underlying file system, potentially leading to unauthorized modifications, data corruption, or even complete file replacement. The impact extends beyond simple privilege escalation as it allows attackers to modify documents that they should only be able to view, creating potential for data integrity breaches and unauthorized content manipulation within the self-hosted environment.
The security implications of this vulnerability align with CWE-284 (Improper Access Control) and can be mapped to ATT&CK techniques such as T1078 (Valid Accounts) and T1566 (Phishing), where attackers might leverage compromised viewer sessions to gain elevated privileges. Organizations using Cloudreve should immediately implement mitigations including upgrading to version 4.17.0 or later, which addresses the validation gap by enforcing proper WOPI token verification. Additional protective measures include implementing network-level controls to monitor and restrict WOPI communication, regularly auditing session tokens, and ensuring that only trusted WOPI viewers are integrated with the system. The fix in version 4.17.0 demonstrates a proper security implementation where complete token validation ensures that requested actions match the granted permissions, thereby preventing unauthorized write operations through forged access tokens.