External risk intelligence

Cloudreve Predictable Secret Key Leads to Full Account Takeover

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-25726

Cloudreve is a self-hosted file management and sharing system typically deployed as a web application accessible over the internet to enable file sharing and remote access. As a web-based service designed for user interaction and file management, it commonly operates as an internet-facing endpoint.

Privilege Escalation

Cloudreve

before 4.13.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability in Cloudreve, a self-hosted file management system, related to how it generates security secrets. An attacker could exploit a weakness in the system's random number generation to predict these secrets, potentially allowing them to take over any user account, including administrators. The main concern is confirming if our environment uses this software and is exposed.

Weak secret generation allows account takeover.
Protects administrator access and sensitive files.
Confirm use; assess exposure and risk.

Attack Path

How an attacker could exploit the issue

An attacker can gain administrative access to Cloudreve by predicting its secret key. This is possible because the system uses a predictable method to generate security secrets, specifically by seeding a pseudo-random number generator with the current time. By observing when an administrator account was created, an attacker can significantly reduce the possibilities for the seed value and then brute-force it to discover the secret key. This allows them to create fraudulent login tokens for any user, including administrators, leading to complete account control.

No authentication needed to start.
Predict system's secret key using time.
Full account takeover and privilege escalation.

Live Threat

Current exploitation, exposure, and threat context

A critical vulnerability in Cloudreve could allow an attacker to predict security secrets, enabling them to forge authentication tokens. This could lead to unauthorized access and control over any user account, including administrative ones, within the self-hosted file management system, when supported by the advisory.

User accounts and system access.
Predict secrets via timing attacks.
Full account takeover and escalation.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Cloudreve application's administrative team is responsible for addressing this critical vulnerability. The first step is to locate all instances of Cloudreve, determine their exposure to the internet, and assess their business criticality. Once identified, the owner of each instance should be confirmed to facilitate a risk-based remediation plan.

Cloudreve administrators own the remediation effort.
Verify internet exposure and business criticality first.
Plan and coordinate upgrades based on assessed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Cloudreve?

Cloudreve is a self-hosted software platform designed to manage and share files. Users deploy it to create their own private cloud storage service, which provides a web interface for uploading, downloading, and organizing files. Because it is self-hosted, the software owner manages the server environment, database, and system configurations directly.

What does CVE-2026-25726 mean for security?

This vulnerability involves a weakness class known as CWE-338, or the use of a cryptographically weak pseudo-random number generator. In this specific case, the software uses the current time to create security secrets. Because this method is predictable, an attacker can guess the system's internal keys and forge authentication tokens, which is equivalent to bypassing the login process entirely to gain full control.

How does an attacker trigger this vulnerability?

An attacker triggers this by narrowing down the window of time when the software was first started, often by checking public account creation timestamps. They then brute-force the predictable seed values to calculate the secret key. Simply interacting with the software or viewing files does not trigger this; it requires the attacker to actively attempt to reconstruct the cryptographic secrets that verify user sessions.

Why should I care if my Cloudreve instance is internet-facing?

Halo Surface Signal notes that Cloudreve is typically deployed as a web application meant for remote access, making it a common internet-facing endpoint. If your instance is reachable from the public internet, an attacker can perform the timing and brute-force attacks necessary to exploit CVE-2026-25726 remotely without needing any prior system access or user credentials.

How do I respond if I am running Cloudreve?

If you are running a version earlier than 4.13.0, you must update to 4.13.0 or later to patch the secret generation logic. Start by auditing your network to identify all running instances of the software and their current versions. Once identified, coordinate with the administrators responsible for those specific servers to plan the update, as patching is the only way to ensure the system generates secure, unpredictable keys.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.