GHSA-vx2m-jpxr-xv7w: Incorrect Authorization Bypass via Context Hint Cache Replay in Cloudreve
Vulnerability ID: GHSA-VX2M-JPXR-XV7W
CVSS Score: 5.3
Published: 2026-08-24
Cloudreve is vulnerable to an incorrect authorization bypass. When listing files, Cloudreve returns a context_hint (represented as a UUID) to the client. If this context hint is replayed on the /file/url or /file/thumb routes, Cloudreve's database file system caches the shareNavigatorState containing the loaded share root. Within the cache lifetime (TTL of 300 seconds), if the user re-requests the same file with the cached hint, the system restores the state and completely bypasses the root security checks (which validate share expiration, remaining download limits, owner status, and passwords). This allows unauthorized users to continue generating signed file URLs and downloading files even after a share has been deleted, has expired, or has reached its download limit.
TL;DR
Unauthenticated users can download files from deleted, expired, or password-protected shares by replaying a cached context hint within a 300-second window, completely bypassing authorization checks.
⚠️ Exploit Status: POC
Technical Details
- Vulnerability Type: Incorrect Authorization (CWE-863)
- Attack Vector: Network
- CVSS v3.1 Score: 5.3 (Medium)
- Exploit Status: Proof of Concept (PoC)
- Cache Window TTL: 300 Seconds
- CISA KEV Status: Not Listed
Affected Systems
- Cloudreve File-Sharing Platform
-
Cloudreve: <= 4.0.0-20260606032813-26b6b1044b02 (Fixed in:
None)
Exploit Details
- GitHub Security Advisory: Reproduction script/guide and technical details in the security advisory.
Mitigation Strategies
- Forced DB re-validation upon restoring cached navigator states.
- Proactive cache invalidation on manual share revocation or configuration changes.
- Enforce strict execution of pre-download hooks by treating database errors as blocking/fatal.
- Deploy WAF rules to strip the X-Cr-Context-Hint header from unauthorized/public request vectors.
Remediation Steps:
- Ensure that database file system state restoration executes IsValidShare on the loaded context.
- Modify pkg/filemanager/manager/entity.go to block signed URL generation on failed BeforeDownload hooks.
- Configure your reverse proxy (e.g. Nginx) to strip X-Cr-Context-Hint from /api/v4/file/url and /api/v4/file/thumb requests.
References
Read the full report for GHSA-VX2M-JPXR-XV7W on our website for more details including interactive diagrams and full exploit analysis.
