CVE-2026-62323 Cloudreve: Unauthorized file write via WOPI view sessions whose access token secret is ignored
Attackers can forge WOPI access tokens to write files via view sessions, allowing unauthorized data modification in Cloudreve.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-62323?
CVE-2026-62323 is a medium-severity missing authorization vulnerability in cloudreve, published on 31 Jul 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, ViewerSessionValidation uses only the session-id prefix of a WOPI access token and does not enforce the requested viewer action, allowing a malicious or compromised WOPI viewer with a view session to forge the token suffix and invoke WOPI write routes for the underlying file. This issue is fixed in version 4.17.0.
Weakness: CWE-863
Which versions are affected by CVE-2026-62323?
7 open source packages ship an affected version, including github.com/cloudreve/Cloudreve/v3, github.com/cloudreve/Cloudreve and github.com/cloudreve/Cloudreve/v4.
| Package | Affected | Fixed in |
|---|---|---|
github.com/cloudreve/Cloudreve/v3 Go | All versions | None |
github.com/cloudreve/Cloudreve/v3 Go | All versions to 3.0.0-20250225100611-da4e44b77af4 | None |
github.com/cloudreve/Cloudreve/v3 Go | All versions to 3.0.0-20250225100611-da4e44b77af4 | None |
github.com/cloudreve/Cloudreve Go | All versions | None |
github.com/cloudreve/Cloudreve/v4 Go | All versions | 4.0.0-20260626022433-f3347130ac48 |
github.com/cloudreve/Cloudreve/v4 Go | All versions | 4.0.0-20260626022433-f3347130ac48 |
1 more packages
github.com/cloudreve/Cloudreve/v4 Go | All versions | 4.0.0-20260626022433-f3347130ac48 |
How do I fix CVE-2026-62323?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-62323 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-62323 exists.
Sources
Also known as GHSA-c3jm-gv5r-9wcp, GO-2026-6104.