CVE-2026-101056

5.3 MEDIUMpublic exploit available

Published 2026-09-27 · Updated 2026-09-28

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Cloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a context_hint UUID. Attackers who previously had valid share access can replay the cached hint to generate signed file URLs for up to 300 seconds after the share is deleted, expires, or reaches zero remaining downloads.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses

CWE-863

Public exploit & PoC references

https://github.com/cloudreve/cloudreve/security/advisories/GHSA-vx2m-jpxr-xv7w

All references

https://github.com/cloudreve/cloudreve/security/advisories/GHSA-vx2m-jpxr-xv7w
https://www.vulncheck.com/advisories/cloudreve-before-4.16.1-authentication-bypass-via-cached-context-hint

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

UNSCOREDCVE-2026-100371PoC
UNSCOREDCVE-2026-100392PoC
MEDIUMCVE-2026-100529PoC
HIGHCVE-2026-100530PoC
HIGHCVE-2026-100535PoC
MEDIUMCVE-2026-100538PoC
LOWCVE-2026-100539PoC
MEDIUMCVE-2026-100540PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.