CVE-2026-55499: Cloudreve Information Disclosure Flaw

CVE-2026-55499 Overview

CVE-2026-55499 is an authorization flaw in Cloudreve, a self-hosted file management and sharing system. Versions prior to 4.17.0 mishandle event-stream subscriptions for single-file shares. When a recipient subscribes to a share event stream, the server resolves the share root to the owner's parent folder and subscribes the recipient to that folder topic. This grants authenticated share recipients visibility into events for unshared sibling files and folders, including names, paths, rename targets, event types, and hashed identifiers. The issue is categorized under [CWE-863: Incorrect Authorization] and is fixed in version 4.17.0.

Critical Impact
Authenticated share recipients can passively collect metadata about unshared files stored in the same parent folder as a shared file, leaking directory structure and file operation activity.

Affected Products

Cloudreve versions prior to 4.17.0
Self-hosted Cloudreve deployments exposing single-file share links
Multi-tenant Cloudreve instances where users share individual files from personal folders

Discovery Timeline

2026-07-31 - CVE-2026-55499 published to NVD
2026-08-01 - Last updated in NVD database

Technical Details for CVE-2026-55499

Vulnerability Analysis

Cloudreve exposes a Server-Sent Events (SSE) endpoint that allows clients to subscribe to file system events under a given Uniform Resource Identifier (URI). For a single-file share, the recipient is authorized to view only one file. However, the subscription handler in service/explorer/events.go resolves the target URI to the owner's parent folder and registers the subscriber against that folder's event topic.

Once subscribed, the recipient receives real-time events for every file in the parent directory. Leaked fields include file names, full paths, rename source and destination values, event types (create, rename, delete), and hashed identifiers. The attacker requires only valid share credentials and network access to the Cloudreve instance.

Root Cause

The root cause is a missing authorization check on the resolved list view. The m.List call returns a SingleFileView flag indicating that the URI represents a single-file share rather than a browsable folder. Prior to 4.17.0, this flag was discarded, and the parent folder returned by List was used as the subscription topic. The authorization boundary of the share (one file) did not match the subscription boundary (parent folder).

Attack Vector

An authenticated recipient of a single-file share opens the share and initiates an event-stream subscription against the share URI. The server accepts the subscription and begins streaming events for the owner's parent folder. The recipient passively collects metadata as the owner or other collaborators modify sibling files. No user interaction from the owner is required beyond normal file operations.

// Security patch in service/explorer/events.go
// Source: https://github.com/cloudreve/cloudreve/commit/0b00dd308f132d6e6e8476857ef79f4865600bbc

// Make sure target is a valid folder that the user can listen to
parent, listRes, err := m.List(c, uri, &manager.ListArgs{
    Page:     0,
    PageSize: 1,
})
if err != nil {
    return serializer.NewError(serializer.CodeParamErr, "Requested uri not available", err)
}

// Reject event subscriptions on single-file views (e.g. single-file shares).
// The listed parent is the underlying owner-side folder containing the file,
// while the subscriber is only authorized to observe the shared file itself.
// Subscribing to that folder topic would leak events about unshared siblings.
if listRes != nil && listRes.SingleFileView {
    return serializer.NewError(serializer.CodeNoPermissionErr, "Event subscriptions are not supported on this view", nil)
}

The patch adds a check on listRes.SingleFileView and rejects the subscription with CodeNoPermissionErr when the resolved view is a single-file share.

Detection Methods for CVE-2026-55499

Indicators of Compromise

Unusual volume of SSE connections from share-recipient accounts to Cloudreve event endpoints
Long-lived event-stream connections originating from users who only hold single-file share access
Repeated subscription requests to share URIs followed by extended text/event-stream responses

Detection Strategies

Inspect Cloudreve access logs for event-stream or SSE subscription requests correlated with share-token authentication
Compare the URI subscribed against the authorization scope of the requesting user to detect scope mismatches
Alert on share-recipient sessions that persist significantly longer than typical single-file download interactions

Monitoring Recommendations

Enable verbose logging on the Cloudreve /api/v4/file/events or equivalent SSE endpoint
Forward Cloudreve application logs to a centralized log platform for correlation with authentication events
Track per-user event subscription counts and flag accounts that subscribe disproportionately relative to their share scope

How to Mitigate CVE-2026-55499

Immediate Actions Required

Upgrade Cloudreve to version 4.17.0 or later, which contains commit 0b00dd308f132d6e6e8476857ef79f4865600bbc
Audit existing single-file shares and rotate share tokens for any files stored alongside sensitive siblings
Review event-stream access logs for evidence of prior subscription abuse by share recipients

Patch Information

The fix is available in the Cloudreve 4.17.0 release. The vulnerability is documented in GitHub Security Advisory GHSA-w8x7-h2px-xmq8 and remediated by the upstream commit, which rejects event subscriptions whose resolved view is a single-file share.

Workarounds

Disable public single-file shares until the instance is upgraded to 4.17.0
Move sensitive files into dedicated folders with no unshared siblings before creating single-file shares
Restrict the Cloudreve event-stream endpoint at the reverse proxy layer to authenticated non-share sessions where feasible

bash

# Verify installed Cloudreve version and upgrade
./cloudreve version

# Pull the fixed release
wget https://github.com/cloudreve/cloudreve/releases/download/4.17.0/cloudreve.tar.gz
tar -xzf cloudreve.tar.gz

# Restart the service after replacing the binary
systemctl restart cloudreve