Read the docs
TI-2026-39397 Aliases CVE-2026-54560GHSA-vgj4-345g-jcf8

Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim

Priority HIGH 68CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

Cloudreve is a self-hosted file management and sharing system. From 4.12.0 until 4.16.1, Cloudreve's OAuth access tokens are issued without the OAuth client_id claim, so the JWT verifier does not load token scopes into request context and RequiredScopes treats the request like non-scoped session authentication, allowing a low-scope OAuth access token to call APIs requiring higher scopes such as file, share, workflow, user setting, WebDAV account, and potentially admin scopes. This issue is fixed in version 4.16.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00582 48th percentileScored 2026-11-07
Fix Fixed cloudreve (cloudreve): 4.16.1github.com/cloudreve/Cloudreve/v4 (Go): 4.0.0-20260606015557-ed20843dc3df

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
cloudrevecloudreve4.12.0 to before 4.16.14.16.1Patch availableCNA
—github.com/cloudreve/Cloudreve/v4 (Go)4.0.0-20260114075425-bc6845bd742c to before 4.0.0-20260606015557-ed20843dc3df4.0.0-20260606015557-ed20843dc3dfPatch availableGHSA-vgj4-345g-jcf8
  • cloudreve Vendorcloudreve Affected 4.12.0 to before 4.16.1 Fixed in 4.16.1 Patch available CNA
  • github.com/cloudreve/Cloudreve/v4 (Go) Vendor— Affected 4.0.0-20260114075425-bc6845bd742c to before 4.0.0-20260606015557-ed20843dc3df Fixed in 4.0.0-20260606015557-ed20843dc3df Patch available GHSA-vgj4-345g-jcf8

Remediation

  • Fix · CNA cloudreve (cloudreve) Fixed in 4.16.1
  • Fix · GHSA-vgj4-345g-jcf8 github.com/cloudreve/Cloudreve/v4 (Go) Fixed in 4.0.0-20260606015557-ed20843dc3df Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54560
  2. 2026-10-03 Alias added: GHSA-vgj4-345g-jcf8

References

Advisory 1

Other 4

  • TI-2026-65089 Cloudreve before 4.16.1 Authentication Bypass via Cached Context Hint CVSS 4.0MEDIUM 6.9
  • TI-2026-40054 Cloudreve: OAuth Admin.Read scope can update OneDrive storage policy credentials CVSS 3.1HIGH 7.1
  • TI-2026-39400 Incorrect authorization in cloudreve CVSS 3.1HIGH 7.1
  • TI-2026-40050 Cloudreve: Server crash through image decompression/pixel bomb in thumbnail & avatar decoding (DoS) CVSS 3.1MEDIUM 6.5
  • TI-2026-39399 Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses CVSS 3.1MEDIUM 6.5
  • TI-2026-44495 Cloudreve: Unauthorized file write via WOPI view sessions whose access token secret is ignored CVSS 3.1MEDIUM 6.3
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences