CVE-2026-55496
Received Received - Intake

Cloudreve User Enumeration via Inactive Account Search

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: GitHub, Inc.

Description
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, GET /api/v4/user/search calls SearchActive without adding a StatusActive predicate and serializes matches at RedactLevelUser, allowing any logged-in user to enumerate email addresses and profile metadata for inactive or banned accounts. The service calls userClient.SearchActive, but despite its name that method filters only by email/nickname keyword and never adds a StatusActive predicate — while the sibling lookups GetActiveByID and GetActiveByDavAccount, defined a few lines above it, do. Search hits are serialized at RedactLevelUser, which includes the email address. This issue is fixed in version 4.17.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-55496
EUVD
EUVD-2026-51391

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cloudreve cloudreve to 4.17.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-359 The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Cloudreve before 4.17.0 has an issue where GET /api/v4/user/search calls SearchActive without filtering for active accounts. This allows logged-in users to list email addresses and profile details of inactive or banned users by searching keywords. The method SearchActive does not add a StatusActive check unlike similar methods.

Detection Guidance

This vulnerability allows enumeration of email addresses and profile metadata for inactive or banned accounts via the GET /api/v4/user/search endpoint. To detect it, monitor for unusual GET requests to this endpoint with parameters like email or nickname keywords. Check server logs for repeated requests targeting inactive accounts.

Impact Analysis

An attacker with a valid account could exploit this to gather personal data of inactive users, including email addresses and profile metadata. This could lead to privacy violations or be used in further attacks like phishing or social engineering.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA by exposing personal data of inactive users without lawful basis. It enables unauthorized access to sensitive information, risking non-compliance with data protection requirements for user privacy and security.

Mitigation Strategies

Upgrade Cloudreve to version 4.17.0 or later to patch the issue. If immediate upgrade is not possible, restrict access to the /api/v4/user/search endpoint or implement rate limiting to reduce exposure. Review logs for past exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55496. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart