{"id":"CVE-2026-55496","title":"Cloudreve is a self-hosted file management and sharing system","summary":"Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, GET /api/v4/user/search calls SearchActive without adding a StatusActive predicate and serializes matches at RedactLevelUser, allowing any logged-in user to …","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cwe":["CWE-200","CWE-359"],"vendor":"cloudreve","product":"github.com/cloudreve/Cloudreve/v4","affected":["github.com/cloudreve/Cloudreve/v4 < 4.0.0-20260613023921-7e1289d55279","github.com/cloudreve/Cloudreve/v3 <= 3.0.0-20250225100611-da4e44b77af4"],"patched":["github.com/cloudreve/Cloudreve/v4 4.0.0-20260613023921-7e1289d55279"],"published":"2026-07-31","updated":"2026-09-08","sourceUpdated":"2026-09-08T20:51:43.490","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55496","references":[{"url":"https://github.com/cloudreve/cloudreve/commit/7e1289d552794bdbeb551be78456115c87dcb3da","label":"security-advisories@github.com"},{"url":"https://github.com/cloudreve/cloudreve/releases/tag/4.17.0","label":"security-advisories@github.com"},{"url":"https://github.com/cloudreve/cloudreve/security/advisories/GHSA-8r7f-r8hj-r3rv","label":"security-advisories@github.com"},{"url":"https://github.com/cloudreve/cloudreve/security/advisories/GHSA-8r7f-r8hj-r3rv","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/advisories/GHSA-8r7f-r8hj-r3rv"}],"tags":["nvd","ghsa","go"],"epss":0.00264,"epssPercentile":0.18638,"aliases":["GHSA-8r7f-r8hj-r3rv"],"ecosystem":"go","ingestedAt":"2026-07-24T21:39:14.954Z","slug":"CVE-2026-55496","body":"## Overview\n\nCloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, GET /api/v4/user/search calls SearchActive without adding a StatusActive predicate and serializes matches at RedactLevelUser, allowing any logged-in user to enumerate email addresses and profile metadata for inactive or banned accounts. The service calls userClient.SearchActive, but despite its name that method filters only by email/nickname keyword and never adds a StatusActive predicate — while the sibling lookups GetActiveByID and GetActiveByDavAccount, defined a few lines above it, do. Search hits are serialized at RedactLevelUser, which includes the email address. This issue is fixed in version 4.17.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-55496)\n\nAffected packages:\n\n- `github.com/cloudreve/Cloudreve/v4 < 4.0.0-20260613023921-7e1289d55279`\n- `github.com/cloudreve/Cloudreve/v3 <= 3.0.0-20250225100611-da4e44b77af4`\n\nPatched in:\n\n- `github.com/cloudreve/Cloudreve/v4 4.0.0-20260613023921-7e1289d55279`\n\nSource: https://github.com/advisories/GHSA-8r7f-r8hj-r3rv","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}