Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| cloudreve | cloudreve | unaffected |
|
No data.
No data.
No data.
No advisories yet.
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Sun, 27 Sep 2026 17:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a context_hint UUID. Attackers who previously had valid share access can replay the cached hint to generate signed file URLs for up to 300 seconds after the share is deleted, expires, or reaches zero remaining downloads. | |
| Title | Cloudreve before 4.16.1 Authentication Bypass via Cached Context Hint | |
| First Time appeared |
Cloudreve
Cloudreve cloudreve |
|
| Weaknesses | CWE-863 | |
| CPEs | cpe:2.3:a:cloudreve:cloudreve:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Cloudreve
Cloudreve cloudreve |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-09-27T17:02:38.060Z
Reserved: 2026-09-27T16:38:56.427Z
Link: CVE-2026-101056
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.