CVE-2026-55496 cloudreve CVE debrief

Who should care

Users of Cloudreve self-hosted file management and sharing system, especially those with sensitive user information, should verify and limit search functionality to prevent enumeration of email addresses and profile metadata. Operators, platform administrators, vulnerability management teams, and security teams should review the vulnerability and implement compensating controls if necessary.

Technical summary

The Cloudreve self-hosted file management and sharing system has a vulnerability prior to version 4.17.0. The GET /api/v4/user/search endpoint calls SearchActive without adding a StatusActive predicate, allowing any logged-in user to enumerate email addresses and profile metadata for inactive or banned accounts. The service serializes matches at RedactLevelUser, which includes the email address. This issue is fixed in version 4.17.0. Affected users should verify and limit search functionality to prevent enumeration of email addresses and profile metadata.

Defensive priority

Logged-in users may be able to enumerate email addresses and profile metadata for inactive or banned accounts; verify and limit search functionality.

Recommended defensive actions

• Verify and limit search functionality to prevent enumeration of email addresses and profile metadata.
• Restrict access to sensitive user information.
• Monitor for suspicious activity related to user enumeration.
• Update to Cloudreve version 4.17.0 or later.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE-2026-55496 record indicates that Cloudreve's self-hosted file management and sharing system has a vulnerability prior to version 4.17.0, allowing logged-in users to enumerate email addresses and profile metadata for inactive or banned accounts via the GET /api/v4/user/search endpoint. The service calls SearchActive without adding a StatusActive predicate and serializes matches at RedactLevelUser, which includes the email address. Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability. Defenders should verify and limit search functionality to prevent enumeration of email addresses and profile metadata, and monitor for suspicious activity related to user enumeration.

Official resources