MEDIUMCVSS 6.3

CVE-2026-62323

CVE-2026-62323 updated by NVD

Published: 2026-07-24
Modified: 2026-09-10
Sources: github-advisory, nvd

Summary

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, ViewerSessionValidation uses only the session-id prefix of a WOPI access token and does not enforce the requested viewer action, allowing a malicious or compromised WOPI viewer with a view session to forge the token suffix and invoke WOPI write routes for the underlying file. This issue is fixed in version 4.17.0.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
Go	github.com/cloudreve/Cloudreve/v3	—	—
Go	github.com/cloudreve/Cloudreve/v4	—	4.0.0-20260626022433-f3347130ac48

Remediation: No patched version is listed by GitHub.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-62323

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.