Skip to content
Heist/ feed
Medium

Cloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached context_hint

Type: advisorySource: OSV1 source record

## Summary Cloudreve's file-listing responses hand the client a `context_hint` (UUID) that is meant to speed up follow-up operations. When that hint is replayed on the `file/url` (and `file/thumb`) routes, DBFS caches a `shareNavigatorState` containing the already-loaded share root and share row. On a later request carrying the same hint, `shareNavigator.RestoreState` repopulates `shareRoot`, and `shareNavigator.To` then **skips `Root`**. `Root` is the only place that re-checks `inventory.IsValidShare` (share expiry, remaining-download count, owner status, source-file validity) and the share password. As a result, a recipient who prewarms a context hint while access is valid can keep minting signed file URLs for already-known shared file paths for up to the context-hint TTL (`5 * 60` = 300 s) after the owner deletes the share or the share expires — plus the lifetime of any signed entity URL minted in that window. This is a **revocation / expiry bypass**, not a way to discover unknown share contents: the attacker must already have had access to the share and must know the target file URI from a prior listing. ## Root cause (verified at `26b6b10`) **1. List responses leak the hint and each file URI** — `service/explorer/response.go` populates `ListResponse.ContextHint` and `FileResponse.Path` (`f.Uri(false).String()`). **2. `file/url` and `file/thumb` accept the client-supplied hint** — `routers/router.go:631` and `:662`: ```go file.POST("url", middleware.ContextHint(), /* ...

Announced Source revision 1
Original source ↗

GHSA-vx2m-jpxr-xv7w

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:GHSA-vx2m-jpxr-xv7w

github.com/cloudreve/Cloudreve/v4

Source reference: /affected/0/package/name

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0"
          },
          {
            "last_affected": "4.0.0-20260606032813-26b6b1044b02"
          }
        ]
      }
    ],
    "package": {
      "name": "github.com/cloudreve/Cloudreve/v4",
      "purl": "pkg:golang/github.com/cloudreve/Cloudreve/v4",
      "ecosystem": "Go"
    },
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-vx2m-jpxr-xv7w/GHSA-vx2m-jpxr-xv7w.json"
    }
  }
]
Related CVEs
CVE-2026-101056

Source reference: /aliases

Publisher severity

No explicit severity was provided.

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2026-101056 · Medium

cloudreve

Event
#21143 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement