CVE-2026-55496Medium· 4.3▾ SunlitCloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, GET /api/v4/user/search calls SearchActive without adding a StatusActive predicate and serializes matches at RedactLevelUser, allowing any logged-in user to …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 31.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Last analysed / modified upstream
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, GET /api/v4/user/search calls SearchActive without adding a StatusActive predicate and serializes matches at RedactLevelUser, allowing any logged-in user to enumerate email addresses and profile metadata for inactive or banned accounts. The service calls userClient.SearchActive, but despite its name that method filters only by email/nickname keyword and never adds a StatusActive predicate — while the sibling lookups GetActiveByID and GetActiveByDavAccount, defined a few lines above it, do. Search hits are serialized at RedactLevelUser, which includes the email address. This issue is fixed in version 4.17.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/cloudreve/Cloudreve/v4 < 4.0.0-20260613023921-7e1289d55279github.com/cloudreve/Cloudreve/v3 <= 3.0.0-20250225100611-da4e44b77af4Patched in:
github.com/cloudreve/Cloudreve/v4 4.0.0-20260613023921-7e1289d55279Connected by shared product, vendor, weakness, or advisory.
GHSA-v6w6-358x-2433Medium· 5.4Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests
CVE-2026-55495Medium· 4.3Cloudreve is a self-hosted file management and sharing system
CVE-2026-55497Medium· 6.5Cloudreve is a self-hosted file management and sharing system
CVE-2026-55499Medium· 4.3Cloudreve is a self-hosted file management and sharing system
CVE-2026-55502High· 7.1Cloudreve is a self-hosted file management and sharing system
CVE-2026-62323Medium· 6.3Cloudreve is a self-hosted file management and sharing system