{ "document": { "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "National Cyber Security Centre", "namespace": "https://www.ncsc.nl/" }, "title": "CVE-2026-101056", "tracking": { "current_release_date": "2026-09-30T01:28:34.349344Z", "generator": { "date": "2026-02-17T15:00:00Z", "engine": { "name": "V.E.L.M.A", "version": "1.7" } }, "id": "CVE-2026-101056", "initial_release_date": "2026-09-27T18:25:27.714551Z", "revision_history": [ { "date": "2026-09-27T18:25:27.714551Z", "number": "1", "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (2).| CWES updated (1)." }, { "date": "2026-09-27T18:25:36.761123Z", "number": "2", "summary": "NCSC Score created." }, { "date": "2026-09-28T06:13:03.094435Z", "number": "3", "summary": "Source created.| CVE status created. (valid)| Description created for source.| References created (1)." }, { "date": "2026-09-28T06:13:03.435049Z", "number": "4", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (1).| References created (1).| CWES updated (1)." }, { "date": "2026-09-28T06:13:08.731032Z", "number": "5", "summary": "NCSC Score updated." }, { "date": "2026-09-28T06:48:42.341499Z", "number": "6", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (71).| References created (4).| CWES updated (1)." }, { "date": "2026-09-28T06:48:51.912427Z", "number": "7", "summary": "NCSC Score updated." }, { "date": "2026-09-28T12:41:21.199788Z", "number": "8", "summary": "CVSS created.| CWES created (1).| Products created (3).| References created (2).| Description created for source.| Unknown change.| Product Identifiers created (1)." }, { "date": "2026-09-28T12:41:23.606583Z", "number": "9", "summary": "NCSC Score updated." }, { "date": "2026-09-28T13:38:31.456946Z", "number": "10", "summary": "Unknown change." }, { "date": "2026-09-29T16:13:05.491251Z", "number": "11", "summary": "EPSS created.| Unknown change." }, { "date": "2026-09-29T18:31:38.338286Z", "number": "12", "summary": "NCSC Score updated." } ], "status": "interim", "version": "12" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:semver/4.16.1", "product": { "name": "vers:semver/4.16.1", "product_id": "CSAFPID-9478793" } }, { "category": "product_version_range", "name": "vers:semver/<4.16.1", "product": { "name": "vers:semver/<4.16.1", "product_id": "CSAFPID-9478794" } }, { "category": "product_version_range", "name": "vers:unknown/3.0.0", "product": { "name": "vers:unknown/3.0.0", "product_id": "CSAFPID-818434" } }, { "category": "product_version_range", "name": "vers:unknown/3.0.0-beta1", "product": { "name": "vers:unknown/3.0.0-beta1", "product_id": "CSAFPID-5999513" } }, { "category": "product_version_range", "name": "vers:unknown/3.0.0-beta2", "product": { "name": "vers:unknown/3.0.0-beta2", "product_id": "CSAFPID-5999515" } }, { "category": "product_version_range", "name": "vers:unknown/3.0.0-beta3", "product": { "name": "vers:unknown/3.0.0-beta3", "product_id": "CSAFPID-5999514" } }, { "category": "product_version_range", "name": "vers:unknown/3.0.0-rc1", "product": { "name": "vers:unknown/3.0.0-rc1", "product_id": "CSAFPID-5999511" } }, { "category": "product_version_range", "name": "vers:unknown/3.1.0", "product": { "name": "vers:unknown/3.1.0", "product_id": "CSAFPID-818444" } }, { "category": "product_version_range", "name": "vers:unknown/3.1.1", "product": { "name": "vers:unknown/3.1.1", "product_id": "CSAFPID-818453" } }, { "category": "product_version_range", "name": "vers:unknown/3.2.0", "product": { "name": "vers:unknown/3.2.0", "product_id": "CSAFPID-818437" } }, { "category": "product_version_range", "name": "vers:unknown/3.2.1", "product": { "name": "vers:unknown/3.2.1", "product_id": "CSAFPID-818450" } }, { "category": "product_version_range", "name": "vers:unknown/3.3.0", "product": { "name": "vers:unknown/3.3.0", "product_id": "CSAFPID-818454" } }, { "category": "product_version_range", "name": "vers:unknown/3.3.1", "product": { "name": "vers:unknown/3.3.1", "product_id": "CSAFPID-818441" } }, { "category": "product_version_range", "name": "vers:unknown/3.3.2", "product": { "name": "vers:unknown/3.3.2", "product_id": "CSAFPID-818447" } }, { "category": "product_version_range", "name": "vers:unknown/3.4.0", "product": { "name": "vers:unknown/3.4.0", "product_id": "CSAFPID-818440" } }, { "category": "product_version_range", "name": "vers:unknown/3.4.0-beta1", "product": { "name": "vers:unknown/3.4.0-beta1", "product_id": "CSAFPID-5999510" } }, { "category": "product_version_range", "name": "vers:unknown/3.4.1", "product": { "name": "vers:unknown/3.4.1", "product_id": "CSAFPID-818452" } }, { "category": "product_version_range", "name": "vers:unknown/3.4.2", "product": { "name": "vers:unknown/3.4.2", "product_id": "CSAFPID-818439" } }, { "category": "product_version_range", "name": "vers:unknown/3.5.0", "product": { "name": "vers:unknown/3.5.0", "product_id": "CSAFPID-818436" } }, { "category": "product_version_range", "name": "vers:unknown/3.5.0-beta.3", "product": { "name": "vers:unknown/3.5.0-beta.3", "product_id": "CSAFPID-8758438" } }, { "category": "product_version_range", "name": "vers:unknown/3.5.0-beta1", "product": { "name": "vers:unknown/3.5.0-beta1", "product_id": "CSAFPID-5999516" } }, { "category": "product_version_range", "name": "vers:unknown/3.5.0-beta2", "product": { "name": "vers:unknown/3.5.0-beta2", "product_id": "CSAFPID-5999507" } }, { "category": "product_version_range", "name": "vers:unknown/3.5.1", "product": { "name": "vers:unknown/3.5.1", "product_id": "CSAFPID-818449" } }, { "category": "product_version_range", "name": "vers:unknown/3.5.2", "product": { "name": "vers:unknown/3.5.2", "product_id": "CSAFPID-818435" } }, { "category": "product_version_range", "name": "vers:unknown/3.5.3", "product": { "name": "vers:unknown/3.5.3", "product_id": "CSAFPID-818442" } }, { "category": "product_version_range", "name": "vers:unknown/3.6.0", "product": { "name": "vers:unknown/3.6.0", "product_id": "CSAFPID-8758436" } }, { "category": "product_version_range", "name": "vers:unknown/3.6.0-beta1", "product": { "name": "vers:unknown/3.6.0-beta1", "product_id": "CSAFPID-8758437" } }, { "category": "product_version_range", "name": "vers:unknown/3.6.1", "product": { "name": "vers:unknown/3.6.1", "product_id": "CSAFPID-8758435" } }, { "category": "product_version_range", "name": "vers:unknown/3.6.2", "product": { "name": "vers:unknown/3.6.2", "product_id": "CSAFPID-8758434" } }, { "category": "product_version_range", "name": "vers:unknown/3.7.0", "product": { "name": "vers:unknown/3.7.0", "product_id": "CSAFPID-8758433" } }, { "category": "product_version_range", "name": "vers:unknown/3.7.1", "product": { "name": "vers:unknown/3.7.1", "product_id": "CSAFPID-8758432" } }, { "category": "product_version_range", "name": "vers:unknown/3.8.0", "product": { "name": "vers:unknown/3.8.0", "product_id": "CSAFPID-8758430" } }, { "category": "product_version_range", "name": "vers:unknown/3.8.0-beta1", "product": { "name": "vers:unknown/3.8.0-beta1", "product_id": "CSAFPID-8758431" } }, { "category": "product_version_range", "name": "vers:unknown/3.8.1", "product": { "name": "vers:unknown/3.8.1", "product_id": "CSAFPID-8758429" } }, { "category": "product_version_range", "name": "vers:unknown/3.8.2", "product": { "name": "vers:unknown/3.8.2", "product_id": "CSAFPID-8758428" } }, { "category": "product_version_range", "name": "vers:unknown/3.8.3", "product": { "name": "vers:unknown/3.8.3", "product_id": "CSAFPID-8758427" } }, { "category": "product_version_range", "name": "vers:unknown/4.0.0", "product": { "name": "vers:unknown/4.0.0", "product_id": "CSAFPID-8758417" } }, { "category": "product_version_range", "name": "vers:unknown/4.0.0-beta.10", "product": { "name": "vers:unknown/4.0.0-beta.10", "product_id": "CSAFPID-8758422" } }, { "category": "product_version_range", "name": "vers:unknown/4.0.0-beta.11", "product": { "name": "vers:unknown/4.0.0-beta.11", "product_id": "CSAFPID-8758421" } }, { "category": "product_version_range", "name": "vers:unknown/4.0.0-beta.12", "product": { "name": "vers:unknown/4.0.0-beta.12", "product_id": "CSAFPID-8758420" } }, { "category": "product_version_range", "name": "vers:unknown/4.0.0-beta.13", "product": { "name": "vers:unknown/4.0.0-beta.13", "product_id": "CSAFPID-8758419" } }, { "category": "product_version_range", "name": "vers:unknown/4.0.0-beta.14", "product": { "name": "vers:unknown/4.0.0-beta.14", "product_id": "CSAFPID-8758418" } }, { "category": "product_version_range", "name": "vers:unknown/4.0.0-beta.6", "product": { "name": "vers:unknown/4.0.0-beta.6", "product_id": "CSAFPID-8758426" } }, { "category": "product_version_range", "name": "vers:unknown/4.0.0-beta.7", "product": { "name": "vers:unknown/4.0.0-beta.7", "product_id": "CSAFPID-8758425" } }, { "category": "product_version_range", "name": "vers:unknown/4.0.0-beta.8", "product": { "name": "vers:unknown/4.0.0-beta.8", "product_id": "CSAFPID-8758424" } }, { "category": "product_version_range", "name": "vers:unknown/4.0.0-beta.9", "product": { "name": "vers:unknown/4.0.0-beta.9", "product_id": "CSAFPID-8758423" } }, { "category": "product_version_range", "name": "vers:unknown/4.1.0", "product": { "name": "vers:unknown/4.1.0", "product_id": "CSAFPID-8758416" } }, { "category": "product_version_range", "name": "vers:unknown/4.1.1", "product": { "name": "vers:unknown/4.1.1", "product_id": "CSAFPID-8758415" } }, { "category": "product_version_range", "name": "vers:unknown/4.1.2", "product": { "name": "vers:unknown/4.1.2", "product_id": "CSAFPID-8758414" } }, { "category": "product_version_range", "name": "vers:unknown/4.1.3", "product": { "name": "vers:unknown/4.1.3", "product_id": "CSAFPID-8758413" } }, { "category": "product_version_range", "name": "vers:unknown/4.10.0", "product": { "name": "vers:unknown/4.10.0", "product_id": "CSAFPID-8758400" } }, { "category": "product_version_range", "name": "vers:unknown/4.10.1", "product": { "name": "vers:unknown/4.10.1", "product_id": "CSAFPID-8758399" } }, { "category": "product_version_range", "name": "vers:unknown/4.11.0", "product": { "name": "vers:unknown/4.11.0", "product_id": "CSAFPID-8758398" } }, { "category": "product_version_range", "name": "vers:unknown/4.11.1", "product": { "name": "vers:unknown/4.11.1", "product_id": "CSAFPID-8758397" } }, { "category": "product_version_range", "name": "vers:unknown/4.12.0", "product": { "name": "vers:unknown/4.12.0", "product_id": "CSAFPID-8758396" } }, { "category": "product_version_range", "name": "vers:unknown/4.12.1", "product": { "name": "vers:unknown/4.12.1", "product_id": "CSAFPID-8758395" } }, { "category": "product_version_range", "name": "vers:unknown/4.13.0", "product": { "name": "vers:unknown/4.13.0", "product_id": "CSAFPID-8850615" } }, { "category": "product_version_range", "name": "vers:unknown/4.14.0", "product": { "name": "vers:unknown/4.14.0", "product_id": "CSAFPID-8850614" } }, { "category": "product_version_range", "name": "vers:unknown/4.14.1", "product": { "name": "vers:unknown/4.14.1", "product_id": "CSAFPID-8850613" } }, { "category": "product_version_range", "name": "vers:unknown/4.15.0", "product": { "name": "vers:unknown/4.15.0", "product_id": "CSAFPID-8850612" } }, { "category": "product_version_range", "name": "vers:unknown/4.16.0", "product": { "name": "vers:unknown/4.16.0", "product_id": "CSAFPID-8850611" } }, { "category": "product_version_range", "name": "vers:unknown/4.2.0", "product": { "name": "vers:unknown/4.2.0", "product_id": "CSAFPID-8758412" } }, { "category": "product_version_range", "name": "vers:unknown/4.3.0", "product": { "name": "vers:unknown/4.3.0", "product_id": "CSAFPID-8758411" } }, { "category": "product_version_range", "name": "vers:unknown/4.4.0", "product": { "name": "vers:unknown/4.4.0", "product_id": "CSAFPID-8758410" } }, { "category": "product_version_range", "name": "vers:unknown/4.4.1", "product": { "name": "vers:unknown/4.4.1", "product_id": "CSAFPID-8758409" } }, { "category": "product_version_range", "name": "vers:unknown/4.5.0", "product": { "name": "vers:unknown/4.5.0", "product_id": "CSAFPID-8758408" } }, { "category": "product_version_range", "name": "vers:unknown/4.5.1", "product": { "name": "vers:unknown/4.5.1", "product_id": "CSAFPID-8758407" } }, { "category": "product_version_range", "name": "vers:unknown/4.6.0", "product": { "name": "vers:unknown/4.6.0", "product_id": "CSAFPID-8758406" } }, { "category": "product_version_range", "name": "vers:unknown/4.7.0", "product": { "name": "vers:unknown/4.7.0", "product_id": "CSAFPID-8758405" } }, { "category": "product_version_range", "name": "vers:unknown/4.8.0", "product": { "name": "vers:unknown/4.8.0", "product_id": "CSAFPID-8758404" } }, { "category": "product_version_range", "name": "vers:unknown/4.9.0", "product": { "name": "vers:unknown/4.9.0", "product_id": "CSAFPID-8758403" } }, { "category": "product_version_range", "name": "vers:unknown/4.9.1", "product": { "name": "vers:unknown/4.9.1", "product_id": "CSAFPID-8758402" } }, { "category": "product_version_range", "name": "vers:unknown/4.9.2", "product": { "name": "vers:unknown/4.9.2", "product_id": "CSAFPID-8758401" } }, { "category": "product_version_range", "name": "vers:unknown/<=4.16.1", "product": { "name": "vers:unknown/<=4.16.1", "product_id": "CSAFPID-9478795", "product_identification_helper": { "cpe": "cpe:2.3:a:cloudreve:cloudreve:*:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "Cloudreve" } ], "category": "vendor", "name": "Cloudreve" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/>=0|<=4.0.0-20260606032813-26b6b1044b02", "product": { "name": "vers:unknown/>=0|<=4.0.0-20260606032813-26b6b1044b02", "product_id": "CSAFPID-9476482" } } ], "category": "product_name", "name": "Cloudreve" } ], "category": "vendor", "name": "cloudreve" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-101056", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "notes": [ { "category": "description", "text": "Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a context_hint UUID. Attackers who previously had valid share access can replay the cached hint to generate signed file URLs for up to 300 seconds after the share is deleted, expires, or reaches zero remaining downloads.", "title": "cveprojectv5 - https://www.cve.org/CVERecord?id=CVE-2026-101056" }, { "category": "description", "text": "Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a context_hint UUID. Attackers who previously had valid share access can replay the cached hint to generate signed file URLs for up to 300 seconds after the share is deleted, expires, or reaches zero remaining downloads.", "title": "nvd - https://nvd.nist.gov/vuln/detail/CVE-2026-101056" }, { "category": "description", "text": "Cloudreve has Broken Access Control - Revoked Share Access Still Allows Signed File URL Generation via Cached context_hint in github.com/cloudreve/Cloudreve", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Go%2FGO-2026-6287.json?alt=media" }, { "category": "description", "text": "## Summary\n \nCloudreve's file-listing responses hand the client a `context_hint` (UUID) that is meant to speed up follow-up operations. When that hint is replayed on the `file/url` (and `file/thumb`) routes, DBFS caches a `shareNavigatorState` containing the already-loaded share root and share row.\n \nOn a later request carrying the same hint, `shareNavigator.RestoreState` repopulates `shareRoot`, and `shareNavigator.To` then **skips `Root`**. `Root` is the only place that re-checks `inventory.IsValidShare` (share expiry, remaining-download count, owner status, source-file validity) and the share password. As a result, a recipient who prewarms a context hint while access is valid can keep minting signed file URLs for already-known shared file paths for up to the context-hint TTL (`5 * 60` = 300 s) after the owner deletes the share or the share expires — plus the lifetime of any signed entity URL minted in that window.\n \nThis is a **revocation / expiry bypass**, not a way to discover unknown share contents: the attacker must already have had access to the share and must know the target file URI from a prior listing.\n\n## Root cause (verified at `26b6b10`)\n \n**1. List responses leak the hint and each file URI** — `service/explorer/response.go` populates `ListResponse.ContextHint` and `FileResponse.Path` (`f.Uri(false).String()`).\n \n**2. `file/url` and `file/thumb` accept the client-supplied hint** — `routers/router.go:631` and `:662`:\n \n```go\nfile.POST(\"url\", middleware.ContextHint(), /* ... */ controllers.FileURL)\nfile.GET(\"thumb\", middleware.ContextHint(), /* ... */ controllers.Thumb)\n```\n \nThe `file` group's only auth gate is `middleware.RequiredScopes(types.ScopeFilesRead)` — there is **no** independent share-validation middleware on this route. All share validation lives inside DBFS.\n \n**3. The middleware trusts the header verbatim** — `middleware/file.go:41`:\n \n```go\nfunc ContextHint() gin.HandlerFunc {\n return func(c *gin.Context) {\n if c.GetHeader(dbfs.ContextHintHeader) != \"\" { // X-Cr-Context-Hint\n util.WithValue(c, dbfs.ContextHintCtxKey{}, uuid.FromStringOrNil(c.GetHeader(dbfs.ContextHintHeader)))\n }\n c.Next()\n }\n}\n```\n \n**4. DBFS restores cached navigator state on a hint hit** — `dbfs.go:745` (`ContextHintTTL = 5 * 60`, `dbfs.go:34`). On a miss it arms `PersistState`; the closure fires in `DBFS.Recycle()` at end of request.\n \n**5. Persisted share state carries the loaded `shareRoot` + `share` row** — `share_navigator.go:72`/`:85`. `RestoreState` reinstates `n.shareRoot`, `n.share`, `n.owner`, etc.\n \n**6. `Root` is the sole validity/password gate** — `share_navigator.go:114` → `inventory.IsValidShare(share)` (`inventory/share.go:227`: `IsShareExpired` checks `Expires.Before(now)` **and** `RemainDownloads <= 0`, plus owner-active and source-file checks) followed by the `share.Password` comparison.\n \n**7. `To` skips `Root` once `shareRoot` is set** — `share_navigator.go:181`:\n \n```go\nfunc (n *shareNavigator) To(ctx context.Context, path *fs.URI) (*File, error) {\n if n.shareRoot == nil { // restored state => NOT nil => Root() skipped\n root, err := n.Root(ctx, path)\n ...\n }\n ...\n}\n```\n \nThe single-file-share branch is **also** affected: it calls `latestSharedSingleFile`, which fetches `n.fileClient.GetByID(n.share.Edges.File.ID)` straight from the restored `share` with no revalidation (`share_navigator.go`).\n \n**8. A failed download hook does not block URL issuance** — `pkg/filemanager/manager/entity.go:250`:\n \n```go\nif err := m.fs.ExecuteNavigatorHooks(ctx, fs.HookTypeBeforeDownload, file); err != nil {\n m.l.Warning(\"Failed to execute navigator hooks: %s\", err) // logged, NOT fatal\n}\n```\n \nThe share's `BeforeDownload` hook is `shareClient.Downloaded()` (`UpdateOneID(share.ID).AddDownloads(1).AddRemainDownloads(-1)`). Against a deleted share this update errors, but the error is only logged and the signed URL is still minted. The signed content endpoint `file/content/:id/...` is then guarded only by `middleware.SignRequired` — it does not re-check the share.\n\n## Steps to reproduce\n \n**Setup:** one share owner; one recipient (a second free account, or anonymous if the default anon group keeps share-download). Recipient knows the share URL (and password, if any).\n \n1. Recipient lists the valid share:\n ```\n GET /api/v4/file?uri= HTTP/1.1\n Host: target\n ```\n Response includes `context_hint` and each file's `path`.\n2. While the share is still valid, recipient warms the cache for a known file:\n ```\n POST /api/v4/file/url HTTP/1.1\n Host: target\n X-Cr-Context-Hint: \n Content-Type: application/json\n \n {\"uri\":[\"\"]}\n ```\n (cache MISS → `Root` runs → `PersistState` armed → `Recycle` writes `shareNavigatorState` to KV under `navigator_state__share`.)\n3. Owner deletes the share, **or** it expires / hits zero remaining downloads.\n4. Within 300 s, recipient repeats the **same** request from step 2 (same `X-Cr-Context-Hint`, same URI).\n (cache HIT → `RestoreState` sets `shareRoot` → `To` skips `Root` → `IsValidShare` never runs → signed entity URL returned.)\n5. The signed URL serves the file content; `file/content/:id/...` validates only the signature.\n**Expected:** step 4 returns `ErrShareNotFound` / `ErrShareLinkExpired`.\n**Actual:** step 4 returns a signed, downloadable URL.\n \n## Impact\n \nA former share recipient (including an anonymous one, under default permissions) can keep minting signed download URLs for already-known shared files for up to 300 s after the owner deletes the share or after time/download-limit expiry, plus the validity window of each signed URL minted in that period. It defeats owner revocation, time expiry, and the remaining-download limit, and bypasses password revalidation on cached state.\n \n## Remediation\n \n- On `RestoreState`, re-run `inventory.IsValidShare` and re-compare the current `share.Password` before trusting cached `shareRoot`; or bind the cached state to an authorization version that changes on any share edit/delete/download-limit change.\n- Do not store authorization-sensitive share state in context-hint cache; treat the hint as a pagination/perf token only.\n- Invalidate `navigator_state_*` entries when a share is edited or deleted.\n- Treat `HookTypeBeforeDownload` failures as blocking for share-backed downloads.\n- Add a regression test: list + prewarm hint, delete share, then `file/url` with the same hint must fail.", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Go%2FGHSA-vx2m-jpxr-xv7w.json?alt=media" }, { "category": "description", "text": "Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a context_hint UUID. Attackers who previously had valid share access can replay the cached hint to generate signed file URLs for up to 300 seconds after the share is deleted, expires, or reaches zero remaining downloads.", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-101056.json?alt=media" }, { "category": "other", "text": "0.00195", "title": "EPSS" }, { "category": "other", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "title": "CVSSV4" }, { "category": "other", "text": "6.9", "title": "CVSSV4 base score" }, { "category": "other", "text": "4.3", "title": "NCSC Score" }, { "category": "other", "text": "Is related to CWE-863 (Incorrect Authorization)", "title": "NCSC Score top increasing factors" }, { "category": "other", "text": "The value of the most recent EPSS score, There is cwe data available from source Nvd, The value of the most recent CVSS (V3) score", "title": "NCSC Score top decreasing factors" } ], "product_status": { "known_affected": [ "CSAFPID-9476482", "CSAFPID-818434", "CSAFPID-818435", "CSAFPID-818436", "CSAFPID-818437", "CSAFPID-818439", "CSAFPID-818440", "CSAFPID-818441", "CSAFPID-818442", "CSAFPID-818444", "CSAFPID-818447", "CSAFPID-818449", "CSAFPID-818450", "CSAFPID-818452", "CSAFPID-818453", "CSAFPID-818454", "CSAFPID-5999507", "CSAFPID-5999510", "CSAFPID-5999511", "CSAFPID-5999513", "CSAFPID-5999514", "CSAFPID-5999515", "CSAFPID-5999516", "CSAFPID-8758395", "CSAFPID-8758396", "CSAFPID-8758397", "CSAFPID-8758398", "CSAFPID-8758399", "CSAFPID-8758400", "CSAFPID-8758401", "CSAFPID-8758402", "CSAFPID-8758403", "CSAFPID-8758404", "CSAFPID-8758405", "CSAFPID-8758406", "CSAFPID-8758407", "CSAFPID-8758408", "CSAFPID-8758409", "CSAFPID-8758410", "CSAFPID-8758411", "CSAFPID-8758412", "CSAFPID-8758413", "CSAFPID-8758414", "CSAFPID-8758415", "CSAFPID-8758416", "CSAFPID-8758417", "CSAFPID-8758418", "CSAFPID-8758419", "CSAFPID-8758420", "CSAFPID-8758421", "CSAFPID-8758422", "CSAFPID-8758423", "CSAFPID-8758424", "CSAFPID-8758425", "CSAFPID-8758426", "CSAFPID-8758427", "CSAFPID-8758428", "CSAFPID-8758429", "CSAFPID-8758430", "CSAFPID-8758431", "CSAFPID-8758432", "CSAFPID-8758433", "CSAFPID-8758434", "CSAFPID-8758435", "CSAFPID-8758436", "CSAFPID-8758437", "CSAFPID-8758438", "CSAFPID-8850611", "CSAFPID-8850612", "CSAFPID-8850613", "CSAFPID-8850614", "CSAFPID-8850615", "CSAFPID-9478794", "CSAFPID-9478795" ], "known_not_affected": [ "CSAFPID-9478793" ] }, "references": [ { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-101056.json?alt=media" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101056" }, { "category": "external", "summary": "Source - ncscclear", "url": "https://vulnerabilities.ncsc.nl/manual/CVE-2026-101056" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Go%2FGHSA-vx2m-jpxr-xv7w.json?alt=media" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Go%2FGO-2026-6287.json?alt=media" }, { "category": "external", "summary": "Source - cveprojectv5", "url": "https://www.cve.org/CVERecord?id=CVE-2026-101056" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss" }, { "category": "external", "summary": "Reference - cveprojectv5; nvd; osv", "url": "https://github.com/cloudreve/cloudreve/security/advisories/GHSA-vx2m-jpxr-xv7w" }, { "category": "external", "summary": "Reference - cveprojectv5; nvd; osv", "url": "https://www.vulncheck.com/advisories/cloudreve-before-4.16.1-authentication-bypass-via-cached-context-hint" }, { "category": "external", "summary": "Reference - osv", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101056.json" }, { "category": "external", "summary": "Reference - osv", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101056" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-5999507", "CSAFPID-5999510", "CSAFPID-5999511", "CSAFPID-5999513", "CSAFPID-5999514", "CSAFPID-5999515", "CSAFPID-5999516", "CSAFPID-818434", "CSAFPID-818435", "CSAFPID-818436", "CSAFPID-818437", "CSAFPID-818439", "CSAFPID-818440", "CSAFPID-818441", "CSAFPID-818442", "CSAFPID-818444", "CSAFPID-818447", "CSAFPID-818449", "CSAFPID-818450", "CSAFPID-818452", "CSAFPID-818453", "CSAFPID-818454", "CSAFPID-8758395", "CSAFPID-8758396", "CSAFPID-8758397", "CSAFPID-8758398", "CSAFPID-8758399", "CSAFPID-8758400", "CSAFPID-8758401", "CSAFPID-8758402", "CSAFPID-8758403", "CSAFPID-8758404", "CSAFPID-8758405", "CSAFPID-8758406", "CSAFPID-8758407", "CSAFPID-8758408", "CSAFPID-8758409", "CSAFPID-8758410", "CSAFPID-8758411", "CSAFPID-8758412", "CSAFPID-8758413", "CSAFPID-8758414", "CSAFPID-8758415", "CSAFPID-8758416", "CSAFPID-8758417", "CSAFPID-8758418", "CSAFPID-8758419", "CSAFPID-8758420", "CSAFPID-8758421", "CSAFPID-8758422", "CSAFPID-8758423", "CSAFPID-8758424", "CSAFPID-8758425", "CSAFPID-8758426", "CSAFPID-8758427", "CSAFPID-8758428", "CSAFPID-8758429", "CSAFPID-8758430", "CSAFPID-8758431", "CSAFPID-8758432", "CSAFPID-8758433", "CSAFPID-8758434", "CSAFPID-8758435", "CSAFPID-8758436", "CSAFPID-8758437", "CSAFPID-8758438", "CSAFPID-8850611", "CSAFPID-8850612", "CSAFPID-8850613", "CSAFPID-8850614", "CSAFPID-8850615", "CSAFPID-9476482", "CSAFPID-9478794", "CSAFPID-9478795" ] } ], "title": "CVE-2026-101056" } ] }