CVE-2026-55499 Cloudreve: Broken access control in file event stream leaks activity events for unshared siblings to single-file share recipients

🗓️ 31 Jul 2026 03:34:33Reported by GoogleType

osv

osv🔗 osv.dev👁 3 Views

CVE-2026-55499: Cloudreve leaks unshared sibling activity to single-file recipients; fix in 4.17.0.

Reporter	Title	Published	Views	Family All 9
ATTACKERKB	CVE-2026-55499	31 Jul 202603:34	–	attackerkb
CVE	CVE-2026-55499	31 Jul 202603:34	–	cve
Cvelist	CVE-2026-55499 Cloudreve: Broken access control in file event stream leaks activity events for unshared siblings to single-file share recipients	31 Jul 202603:34	–	cvelist
EUVD	EUVD-2026-51393	31 Jul 202603:34	–	euvd
Github Security Blog	Cloudreve: Broken Access Control in file event stream: a single-file share recipient is subscribed to the owner's parent folder and receives activity events for unshared siblings	24 Jul 202620:49	–	github
NVD	CVE-2026-55499	31 Jul 202604:17	–	nvd
OSV	GHSA-W8X7-H2PX-XMQ8 Cloudreve: Broken Access Control in file event stream: a single-file share recipient is subscribed to the owner's parent folder and receives activity events for unshared siblings	24 Jul 202620:49	–	osv
Positive Technologies	PT-2026-64434	24 Jul 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-55499 Cloudreve: Broken access control in file event stream leaks activity events for unshared siblings to single-file share recipients	31 Jul 202603:34	–	vulnrichment

Source	Link
github	www.github.com/cloudreve/cloudreve/releases/tag/4.17.0
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55499.json
github	www.github.com/cloudreve/cloudreve/security/advisories/GHSA-w8x7-h2px-xmq8
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-55499
github	www.github.com/cloudreve/cloudreve/commit/0b00dd308f132d6e6e8476857ef79f4865600bbc

02 Aug 2026 03:32Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.14.3

EPSS0.00331

Cloudreve Access control Event stream Unshared siblings Single file share Recipients Version 4.17.0