Cloudreve versions prior to 4.17.0 expose sensitive user profile data, including email addresses and other metadata, for accounts that are inactive or banned. The vulnerability exists in the GET /api/v4/user/search endpoint, which invokes a function named SearchActive but does not apply the required active-status filter. The resulting data set is serialized with a RedactLevel that still contains email addresses, enabling any authenticated user to enumerate private information for accounts that should remain hidden. The flaw triggers a privacy violation classified as CWE-200 and CWE-359.

The affected product is the Cloudreve self-hosted file management and sharing platform, specifically all releases 4.16.x and earlier. The issue is resolved in release 4.17.0; installations running any newer version are not affected.

The vulnerability scores a CVSS of 4.3, indicating moderate confidentiality impact without denial-of-service or privilege-escalation effects. The EPSS score is less than 1%, suggesting exploitation is unlikely in the wild, and the flaw is not listed in the CISA KEV catalog. Attackers who can authenticate to the application can exploit the flaw simply by making a /api/v4/user/search request; no additional privileges are required. Because the active-status predicate is omitted, enumeration does not stop at active accounts, potentially exposing dozens of private email addresses.