CVE-2026-62323: Cloudreve Auth Bypass Vulnerability

CVE-2026-62323 Overview

CVE-2026-62323 is an authorization vulnerability in Cloudreve, a self-hosted file management and sharing system. Versions prior to 4.17.0 contain a flaw in the ViewerSessionValidation middleware. The function validates only the session-id prefix of a Web Application Open Platform Interface (WOPI) access token and fails to enforce the requested viewer action. A malicious or compromised WOPI viewer holding a view session can forge the token suffix and invoke WOPI write routes against the underlying file. The issue is fixed in Cloudreve 4.17.0 and is classified under CWE-863: Incorrect Authorization.

Critical Impact
An attacker with a valid view session can escalate to write access on shared files, tampering with content without permission.

Affected Products

Cloudreve versions prior to 4.17.0
Cloudreve deployments with WOPI viewer integration enabled
Self-hosted Cloudreve instances exposing shared documents to external viewers

Discovery Timeline

2026-07-31 - CVE-2026-62323 published to the National Vulnerability Database
2026-07-31 - Last updated in NVD database

Technical Details for CVE-2026-62323

Vulnerability Analysis

Cloudreve implements WOPI to integrate external document viewers with its file storage backend. The ViewerSessionValidation middleware in middleware/wopi.go gates access to WOPI routes using an access token. The token is composed of a session-id prefix and an action-bound suffix.

The pre-patch middleware inspects only the session-id prefix. It does not compare the token suffix against the requested viewer action, nor does it enforce that a view session may reach only read routes. A caller possessing a legitimate view session can construct a token whose suffix targets write operations. The middleware accepts the token, and the request proceeds to WOPI write handlers such as PutFile.

Because the flaw sits in shared middleware, any WOPI write route reachable from an authenticated view session is exposed. The result is unauthorized modification of files that the session was only entitled to read.

Root Cause

The root cause is incomplete token validation. The middleware treats the session-id prefix as sufficient proof of authorization and never enforces action binding. It also uses non-constant-time string comparison, which the patch addresses by introducing crypto/subtle for safe comparison.

Attack Vector

Exploitation requires network access to the Cloudreve WOPI endpoint and a valid low-privilege view session. The attacker forges a token suffix that references a write action, then issues a request to a WOPI write route. User interaction is required because the flow depends on a viewer session being initiated. The confidentiality impact is limited, but integrity impact is high because file contents can be overwritten.

// Patch: middleware/wopi.go - fix(middleware): improve access
// token validation in ViewerSessionValidation
 package middleware

 import (
+	"crypto/subtle"
+	"net/http"
+	"strings"
+
 	"github.com/cloudreve/Cloudreve/v4/application/dependency"
 	"github.com/cloudreve/Cloudreve/v4/inventory/types"
 	"github.com/cloudreve/Cloudreve/v4/pkg/filemanager/manager"
 	"github.com/cloudreve/Cloudreve/v4/pkg/hashid"
 	"github.com/cloudreve/Cloudreve/v4/pkg/util"
 	"github.com/cloudreve/Cloudreve/v4/pkg/wopi"
 	"github.com/gin-gonic/gin"
-	"net/http"
-	"strings"
 )

 // WopiWriteAccess validates if write access is obtained.

Source: Cloudreve commit f3347130

Detection Methods for CVE-2026-62323

Indicators of Compromise

Requests to WOPI write endpoints (for example PutFile) originating from sessions that were established for view-only actions.
Unexpected file modification events in Cloudreve audit logs shortly after a viewer session was opened.
Access tokens whose suffix does not match the action recorded for the initiating session.

Detection Strategies

Compare the action recorded when a WOPI session is created with the action invoked on subsequent WOPI route calls, and alert on mismatches.
Instrument the Cloudreve WOPI middleware layer to log the full token, the resolved session action, and the requested route for offline correlation.
Baseline normal viewer traffic per user and flag view sessions that transition to write operations without an editor session being issued.

Monitoring Recommendations

Forward Cloudreve application logs and reverse-proxy access logs to a centralized store to preserve WOPI request context.
Monitor for unusual write volume on files that were recently shared as view-only.
Track deployed Cloudreve versions across the environment and alert when any instance runs a release earlier than 4.17.0.

How to Mitigate CVE-2026-62323

Immediate Actions Required

Upgrade all Cloudreve instances to version 4.17.0 or later, which enforces action binding and uses constant-time token comparison.
Audit recent file modifications on documents opened through WOPI viewers to identify unauthorized changes.
Revoke and reissue active WOPI sessions after upgrading to invalidate any tokens crafted before the patch.

Patch Information

The fix is available in Cloudreve release 4.17.0. The corrective change is tracked in commit f3347130 and documented in GitHub Security Advisory GHSA-c3jm-gv5r-9wcp. The patch imports crypto/subtle and hardens the ViewerSessionValidation middleware to enforce the requested viewer action.

Workarounds

Disable WOPI viewer integration until the upgrade to 4.17.0 is completed.
Restrict WOPI endpoint exposure to trusted network segments using reverse-proxy allow lists.
Limit sharing of sensitive files through view-only WOPI sessions while the vulnerable middleware is in place.

bash

# Upgrade Cloudreve to the patched release
docker pull cloudreve/cloudreve:4.17.0
docker stop cloudreve && docker rm cloudreve
docker run -d --name cloudreve \
  -p 5212:5212 \
  -v /opt/cloudreve/data:/cloudreve/data \
  cloudreve/cloudreve:4.17.0

# Verify version after restart
curl -s http://localhost:5212/api/v3/site/config | grep -i version