Cloudreve, a self-hosted file management system, contained an access‑control flaw where a single-file share event‑stream resolved to the owner’s parent folder. This allowed any authenticated recipient of a shared file to receive metadata such as names, paths, rename targets, event types, and hashed identifiers for sibling files and folders that had not been explicitly shared. The defect is an instance of CWE‑863—"Improper Authorization"—and permits disclosure of file‑level information to users who should not have visibility outside the shared file.

All deployments of Cloudreve before version 4.17.0 are affected. The issue was fixed in the 4.17.0 release; thus any instance running an earlier version of the software should be considered vulnerable.

The CVSS score of 4.3 indicates a low overall risk, and the EPSS score of <1% indicates a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated user with a single-file share link who can subscribe to that file’s event stream. Attackers must be able to trigger or access the event‑stream subscription endpoint; no remote code execution or elevated privilege escalation is required.