CVE-2026-101056 Overview
Cloudreve versions before 4.16.1 contain an authorization flaw in share access handling. The application fails to revalidate share permissions when restoring cached navigator state from a context_hint UUID. Attackers who previously held valid share access can replay the cached hint to generate signed file URLs for up to 300 seconds after the share has been deleted, expired, or exhausted its remaining download count. The issue is tracked as CWE-863: Incorrect Authorization.
Critical Impact
Revoked share recipients can continue to retrieve shared file contents for a 300-second window after revocation, bypassing deletion, expiration, and download-count controls.
Affected Products
- Cloudreve versions prior to 4.16.1
- Self-hosted Cloudreve file-sharing deployments
- Cloudreve instances exposing share links to untrusted recipients
Discovery Timeline
- 2026-09-27 - CVE-2026-101056 published to NVD
- 2026-09-28 - Last updated in NVD database
Technical Details for CVE-2026-101056
Vulnerability Analysis
Cloudreve exposes a context_hint parameter, implemented as a UUID, that caches navigator state tied to a share. The cached state includes the resolved share context used to construct signed URLs for file downloads. When a request includes a valid context_hint, the server restores the cached context and issues signed URLs without re-checking whether the underlying share remains valid.
The caching window persists for approximately 300 seconds. During that window, revocation events such as share deletion, expiration timestamps, or exhaustion of the remaining-download counter are not consulted. The authorization decision depends entirely on the presence of a prior cached state rather than on the current share record.
The flaw is an authorization check failure rather than an authentication bypass. The attacker must have previously accessed the share while it was valid. The impact is bounded to confidentiality of file contents, with no integrity or availability consequences reported by the upstream advisory.
Root Cause
The root cause is missing revalidation in the share-access code path that restores cached navigator state. The server trusts the context_hint UUID as a sufficient indicator of continued access and skips the lookup against the current share record. This matches the [CWE-863] pattern where an access decision is based on stale or incomplete authorization data.
Attack Vector
The attack is network-reachable and requires no authentication or user interaction beyond the attacker's own prior share access. An attacker captures the context_hint UUID returned when they first open a valid share. After the share owner deletes the share, lets it expire, or exhausts the download quota, the attacker replays the context_hint to the Cloudreve API. The server returns freshly signed file URLs that can be used to download the shared content until the 300-second cache entry ages out.
No exploitation code is required beyond standard HTTP tooling. Refer to the GitHub Security Advisory GHSA-vx2m-jpxr-xv7w and the VulnCheck Advisory for Cloudreve for upstream technical detail.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-101056
Indicators of Compromise
- Signed file-download URLs issued for share identifiers that are no longer present in the Cloudreve database.
- Successful download requests referencing a context_hint UUID after the associated share's expires_at timestamp.
- Download counts on a share continuing to increment after the remaining-downloads value has reached zero.
Detection Strategies
- Correlate share-deletion and expiration events with subsequent file-download events keyed by the same share identifier within a 300-second window.
- Alert on repeated use of the same context_hint UUID from a client after the associated share has been revoked.
- Review application logs for signed-URL generation requests that reference share records absent from the current data store.
Monitoring Recommendations
- Enable verbose logging for the share-resolution and signed-URL issuance paths in Cloudreve.
- Forward Cloudreve access logs to a central analytics platform and retain share lifecycle events alongside download events.
- Baseline normal share-access timing and flag downloads that occur after revocation events.
How to Mitigate CVE-2026-101056
Immediate Actions Required
- Upgrade Cloudreve to version 4.16.1 or later on all self-hosted instances.
- Audit active share links and revoke any shares whose recipients should no longer have access, then wait at least 300 seconds before assuming revocation is effective on unpatched hosts.
- Rotate or invalidate any sensitive files that were exposed via share links on unpatched versions.
Patch Information
The maintainers addressed the issue in Cloudreve 4.16.1 by revalidating share access when restoring cached navigator state from a context_hint. Review the GitHub Security Advisory GHSA-vx2m-jpxr-xv7w for upstream remediation detail and version guidance.
Workarounds
- Restrict Cloudreve share functionality to trusted network segments until the upgrade is applied.
- Avoid relying on share deletion, expiration, or download-count exhaustion as an immediate revocation mechanism on unpatched versions.
- Prefer short-lived shares with narrowly scoped recipients to reduce the window during which a context_hint can be captured and replayed.
# Verify the running Cloudreve version and upgrade to a fixed release
cloudreve version
# Expected output after remediation: 4.16.1 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
