CVE-2026-62323 Cloudreve: Unauthorized file write via WOPI view sessions whose access token secret is ignored

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, ViewerSessionValidation uses only the session-id prefix of a WOPI access token and does not enforce the requested viewer action, allowing a malicious or compromised WOPI viewer with a view session to forge the token...

CVE-2026-62323

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, ViewerSessionValidation uses only the session-id prefix of a WOPI access token and does not enforce the requested viewer action, allowing a malicious or compromised WOPI viewer with a view session to forge the token...

CVE-2026-62323

CVE-2026-62323 affects Cloudreve prior to 4.17.0 where WOPI viewer sessions can bypass token suffix validation. The WOPI middleware only checks the session ID prefix and does not compare the full access_token to the stored token, allowing a forged suffix to authorize read and, crucially, write op...

EUVD-2026-51395

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, ViewerSessionValidation uses only the session-id prefix of a WOPI access token and does not enforce the requested viewer action, allowing a malicious or compromised WOPI viewer with a view session to forge the token...