PT-2026-99568

CVE-2026-101056

Published

2026-08-24

Updated

2026-09-28

Description by

CVSS 4.0

6.9

Medium

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Cloudreve versions prior to 4.16.1

Description The software fails to revalidate share access when restoring cached navigator state from a context hint UUID. This allows attackers who previously held valid share access to replay the cached hint to generate signed file URLs for up to 300 seconds after the share has been deleted, expired, or reached the limit of remaining downloads.

Recommendations Update to version 4.16.1 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Riodrwn

Vendors

Affected products

Weakness enumeration

CWE-863: Incorrect Authorization

Related identifiers