CVE-2026-101056 Details

A vulnerability exists in Cloudreve versions prior to 4.16.1, where the application fails to properly revalidate share access when restoring cached navigator states from a context_hint UUID. This flaw allows attackers who previously had valid share access to replay the cached hint and generate signed file URLs for up to 300 seconds after the share is deleted, expires, or reaches zero remaining downloads. The issue arises because the application's file URL and thumbnail routes accept client-supplied context hints without proper validation, enabling the restoration of cached share states that bypass expiration and revocation checks.

To address this vulnerability, Cloudreve should implement a revalidation of share access on cached context hints before restoring the share state. Additionally, the application should invalidate context hint cache entries when a share is edited or deleted.