CVE-2026-55496

Name of the Vulnerable Software and Affected Versions Cloudreve versions prior to 4.17.0

Description Any logged-in user can enumerate and retrieve email addresses and profile metadata (including nicknames, avatars, creation time, and profile share-visibility) of inactive or banned accounts. This occurs because the SearchActive() function fails to apply a StatusActive predicate, which should filter out non-active users. Consequently, the system returns results serialized at RedactLevelUser, which includes the user's email address.

The issue is accessible via the following endpoint:

Additionally, a secondary path exists via 'GET /api/v4/user/info/:id' where the GetUser() function also lacks a status filter, potentially allowing a logged-in user with a target's hashed ID to retrieve their email.

Recommendations Update to version 4.17.0. As a temporary mitigation, restrict access to the 'GET /api/v4/user/search' and 'GET /api/v4/user/info/:id' endpoints to authorized administrative users only.