Read the docs
TI-2026-54107 Aliases CVE-2026-77637GHSA-w89x-c962-c44g

Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope

Priority LOW 18CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, tool.GET("wopi") and tool.POST("mail") in routers/router.go inherit ScopeAdminRead but omit the RequiredScopes(types.ScopeAdminWrite) middleware applied to neighboring state-changing admin tool routes. An OAuth application or API key limited to Admin.Read can therefore probe configured WOPI service endpoints and send arbitrary test email through the server SMTP configuration, exceeding the token's intended read-only authorization boundary. This issue is fixed in version 4.18.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00326 25th percentileScored 2026-11-07
Fix Fixed cloudreve (cloudreve): 4.18.0github.com/cloudreve/Cloudreve/v4 (Go): 4.0.0-20260715070110-bce08f88e9d8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
cloudrevecloudrevebefore 4.18.04.18.0Patch availableCNA
—github.com/cloudreve/Cloudreve/v4 (Go)before 4.0.0-20260715070110-bce08f88e9d84.0.0-20260715070110-bce08f88e9d8Patch availableGHSA-w89x-c962-c44g
  • cloudreve Vendorcloudreve Affected before 4.18.0 Fixed in 4.18.0 Patch available CNA
  • github.com/cloudreve/Cloudreve/v4 (Go) Vendor— Affected before 4.0.0-20260715070110-bce08f88e9d8 Fixed in 4.0.0-20260715070110-bce08f88e9d8 Patch available GHSA-w89x-c962-c44g

Remediation

  • Fix · CNA cloudreve (cloudreve) Fixed in 4.18.0
  • Fix · GHSA-w89x-c962-c44g github.com/cloudreve/Cloudreve/v4 (Go) Fixed in 4.0.0-20260715070110-bce08f88e9d8 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-77637
  2. 2026-10-03 Alias added: GHSA-w89x-c962-c44g

References

Advisory 1

Other 4

  • TI-2026-65089 Cloudreve before 4.16.1 Authentication Bypass via Cached Context Hint CVSS 4.0MEDIUM 6.9
  • TI-2026-39397 Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim CVSS 3.1HIGH 7.6
  • TI-2026-40054 Cloudreve: OAuth Admin.Read scope can update OneDrive storage policy credentials CVSS 3.1HIGH 7.1
  • TI-2026-39400 Incorrect authorization in cloudreve CVSS 3.1HIGH 7.1
  • TI-2026-40050 Cloudreve: Server crash through image decompression/pixel bomb in thumbnail & avatar decoding (DoS) CVSS 3.1MEDIUM 6.5
  • TI-2026-39399 Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses CVSS 3.1MEDIUM 6.5
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences