CVE-2026-101056: Cloudreve before 4.16.1 Authentication Bypass via Cached Context Hint

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-27 · updated 2026-10-08
Weakness: CWE-863

Description

Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a context_hint UUID. Attackers who previously had valid share access can replay the cached hint to generate signed file URLs for up to 300 seconds after the share is deleted, expires, or reaches zero remaining downloads.

Affected products

cloudreve: before 4.16.1 — fixed in 4.16.1

How to fix

Upgrade to a fixed version: cloudreve 4.16.1. Check the vendor advisory for mitigations.

References

https://github.com/cloudreve/cloudreve/security/advisories/GHSA-vx2m-jpxr-xv7w
https://www.vulncheck.com/advisories/cloudreve-before-4.16.1-authentication-bypass-via-cached-context-hint

Get alerted when CVE-2026-101056 or the next vulnerability affects your stack