{"cve":"CVE-2026-55499","nvd":{"published":"2026-07-31T04:17:23.380","modified":"2026-09-08T20:51:43.490","status":"Deferred","description":"Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, a single-file share event-stream subscription resolves the share root to the owner’s parent folder and subscribes to that folder topic, allowing an authenticated share recipient to receive names, paths, rename targets, event types, and hashed identifiers for unshared sibling files and folders. This issue is fixed in version 4.17.0.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3},"cwes":["CWE-863"],"references":["https://github.com/cloudreve/cloudreve/commit/0b00dd308f132d6e6e8476857ef79f4865600bbc","https://github.com/cloudreve/cloudreve/releases/tag/4.17.0","https://github.com/cloudreve/cloudreve/security/advisories/GHSA-w8x7-h2px-xmq8","https://github.com/cloudreve/cloudreve/security/advisories/GHSA-w8x7-h2px-xmq8"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:47:10.050265369+00:00"},"epss":{"cve":"CVE-2026-55499","score":0.00331,"percentile":0.26296,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-w8x7-h2px-xmq8","url":"https://osv.dev/vulnerability/GHSA-w8x7-h2px-xmq8","summary":"Cloudreve: Broken Access Control in file event stream: a single-file share recipient is subscribed to the owner's parent folder and receives activity events for unshared siblings","modified":"2026-08-18T15:10:42.247237222Z","packages":[{"ecosystem":"Go","name":"github.com/cloudreve/Cloudreve/v4","purl":"pkg:golang/github.com/cloudreve/Cloudreve/v4","ranges":["<4.0.0-20260613030215-0b00dd308f13"],"fixed":["4.0.0-20260613030215-0b00dd308f13"]},{"ecosystem":"Go","name":"github.com/cloudreve/Cloudreve/v3","purl":"pkg:golang/github.com/cloudreve/Cloudreve/v3","ranges":["<=3.0.0-20250225100611-da4e44b77af4"],"fixed":[]}]},{"id":"GO-2026-6102","url":"https://osv.dev/vulnerability/GO-2026-6102","summary":"Cloudreve: Broken Access Control in file event stream: a single-file share recipient is subscribed to the owner's parent folder and receives activity events for unshared siblings in github.com/cloudreve/Cloudreve","modified":"2026-08-18T15:00:16.143005609Z","packages":[{"ecosystem":"Go","name":"github.com/cloudreve/Cloudreve","purl":"pkg:golang/github.com/cloudreve/Cloudreve","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/cloudreve/Cloudreve/v3","purl":"pkg:golang/github.com/cloudreve/Cloudreve/v3","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/cloudreve/Cloudreve/v4","purl":"pkg:golang/github.com/cloudreve/Cloudreve/v4","ranges":["<4.0.0-20260613030215-0b00dd308f13"],"fixed":["4.0.0-20260613030215-0b00dd308f13"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}