Cloudreve EUVD-2026-87981

Exploitation requires the attacker to have held valid access to a specific Cloudreve share and to know a target file URI from a prior file listing (the context_hint UUID and FileResponse.Path are leaked in list responses). The attacker must pre-warm the context_hint by hitting file/url or file/thumb while access is still valid, so DBFS caches shareNavigatorState. The bypass then only works for up to 300 seconds (ContextHintTTL = 5*60) after the share is deleted, expires, or reaches zero remaining downloads, plus any signed-entity-URL lifetime minted in that window. It does NOT allow discovery of unknown or never-accessed share contents. Limiting factors: prior authorized access, knowledge of file URIs, a pre-warmed hint, and a strict ~5-minute race window - a password-protected share's password check is also among the controls skipped only for already-known content.

This is a genuine but narrowly-scoped access-control flaw (CWE-863) rated moderate. The vendor CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) yields 6.9 by treating the attack as trivially remote and unauthenticated, but the advisory itself constrains this heavily: the attacker MUST already have had legitimate share access, MUST know the target file URI from a prior listing, MUST have pre-warmed a context_hint while access was valid, and only has a ~300-second window after revocation/expiry. That makes real-world attack complexity higher than AC:L suggests - this is a revocation/expiry-bypass race, not open unauthenticated data exposure. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so there is no evidence of active or automated exploitation. Impact is confidentiality-only and low (VC:L): the attacker re-accesses files they already had access to for a brief window; there is no integrity or availability impact and no discovery of unknown share contents. Net: a real correctness/security bug worth patching, but a low practical priority - not a high-CVSS-but-hollow finding, rather a moderate score whose preconditions make widespread abuse unlikely.

A user is granted access to a Cloudreve share, browses it, and their client silently caches a context_hint UUID plus known file URIs. The owner then deletes the share (or it expires / hits zero remaining downloads), but the ex-recipient replays the cached hint against the file/url route and continues minting valid signed download URLs for up to 300 seconds - plus the lifetime of any signed entity URL created in that window. No public exploit code is identified at time of analysis.