{"vulnerability": "GHSA-VX2M-JPXR-XV7W", "sightings": [{"uuid": "94fb56be-e4ed-476a-9ba1-2e2563995f98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-VX2M-JPXR-XV7W", "type": "seen", "source": "https://gist.github.com/alon710/79e310cba90f4f1f20958718aaca8ae9", "content": "# GHSA-VX2M-JPXR-XV7W: GHSA-vx2m-jpxr-xv7w: Incorrect Authorization Bypass via Context Hint Cache Replay in Cloudreve\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-08-24\n> **Full Report:** https://cvereports.com/reports/GHSA-VX2M-JPXR-XV7W\n\n## Summary\nCloudreve is vulnerable to an incorrect authorization bypass. When listing files, Cloudreve returns a context_hint (represented as a UUID) to the client. If this context hint is replayed on the /file/url or /file/thumb routes, Cloudreve's database file system caches the shareNavigatorState containing the loaded share root. Within the cache lifetime (TTL of 300 seconds), if the user re-requests the same file with the cached hint, the system restores the state and completely bypasses the root security checks (which validate share expiration, remaining download limits, owner status, and passwords). This allows unauthorized users to continue generating signed file URLs and downloading files even after a share has been deleted, has expired, or has reached its download limit.\n\n## TL;DR\nUnauthenticated users can download files from deleted, expired, or password-protected shares by replaying a cached context hint within a 300-second window, completely bypassing authorization checks.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **Vulnerability Type**: Incorrect Authorization (CWE-863)\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 5.3 (Medium)\n- **Exploit Status**: Proof of Concept (PoC)\n- **Cache Window TTL**: 300 Seconds\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Cloudreve File-Sharing Platform\n- **Cloudreve**: <= 4.0.0-20260606032813-26b6b1044b02 (Fixed in: `None`)\n\n## Mitigation\n\n- Forced DB re-validation upon restoring cached navigator states.\n- Proactive cache invalidation on manual share revocation or configuration changes.\n- Enforce strict execution of pre-download hooks by treating database errors as blocking/fatal.\n- Deploy WAF rules to strip the X-Cr-Context-Hint header from unauthorized/public request vectors.\n\n**Remediation Steps:**\n1. Ensure that database file system state restoration executes IsValidShare on the loaded context.\n2. Modify pkg/filemanager/manager/entity.go to block signed URL generation on failed BeforeDownload hooks.\n3. Configure your reverse proxy (e.g. Nginx) to strip X-Cr-Context-Hint from /api/v4/file/url and /api/v4/file/thumb requests.\n\n## References\n\n- [GitHub Security Advisory GHSA-vx2m-jpxr-xv7w](https://github.com/advisories/GHSA-vx2m-jpxr-xv7w)\n- [Cloudreve Security Advisory](https://github.com/cloudreve/cloudreve/security/advisories/GHSA-vx2m-jpxr-xv7w)\n- [Cloudreve Repository](https://github.com/cloudreve/cloudreve)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-VX2M-JPXR-XV7W) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-25T11:31:12.406694Z"}]}