Cloudreve versions before 4.16.1 do not revalidate share access when restoring a cached navigator state from a context_hint UUID. Attackers who previously had valid share access can replay the cached hint to generate signed file URLs for up to 300 seconds after the share is deleted, expires, or reaches zero remaining downloads, enabling unauthorized access to shared files.

The vulnerability affects all installations of Cloudreve earlier than version 4.16.1, regardless of deployment environment or operating system.

The CVSS score of 6.9 indicates a medium severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an attacker with prior valid share access replaying a cached context hint; no external exploitation path is described. The risk is that such a replay can provide temporary unauthorized authenticated file access.