Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.8
CVE-2026-77637: Cloudreve admin read token can change settings and send email
CVE-2026-77637 · published 27 days ago
Summary
In versions of Cloudreve before 4.18.0, an OAuth token that was supposed to allow only read‑only access could also be used to call admin functions that change data, such as checking WOPI service endpoints and sending test emails through the server’s SMTP settings. This means a user with limited permissions could perform actions beyond what was intended. Upgrade Cloudreve to version 4.18.0 or later to close the gap.
What to do
- Update github.com cloudreve to version 4.0.0-20260715070110-bce08f88e9d8.
- Update cloudreve github.com/cloudreve/cloudreve/v4 to version 4.0.0-20260715070110-bce08f88e9d8.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | cloudreve | cloudreve | < 4.18.0 |
| go | github.com | cloudreve |
< 4.0.0-20260715070110-bce08f88e9d8 Fix: upgrade to 4.0.0-20260715070110-bce08f88e9d8
|
| Go | cloudreve | github.com/cloudreve/cloudreve/v4 |
< 4.0.0-20260715070110-bce08f88e9d8 Fix: upgrade to 4.0.0-20260715070110-bce08f88e9d8
|
Original advisory text
Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope
Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, tool.GET("wopi") and tool.POST("mail") in routers/router.go inherit ScopeAdminRead but omit the RequiredScopes(types.ScopeAdminWrite) middleware applied to neighboring state-changing admin tool routes. An OAuth application or API key limited to Admin.Read can therefore probe configured WOPI service endpoints and send arbitrary test email through the server SMTP configuration, exceeding the token's intended read-only authorization boundary. This issue is fixed in version 4.18.0.
References
- https://github.com/cloudreve/cloudreve/security/advisories/GHSA-w89x-c962-c44g
- https://github.com/cloudreve/cloudreve/commit/bce08f88e9d8f881e78fd18e7a6598b319...
- https://github.com/cloudreve/cloudreve/releases/tag/4.18.0
- https://nvd.nist.gov/vuln/detail/CVE-2026-77637
- https://github.com/advisories/GHSA-w89x-c962-c44g
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77637... Vendor Advisory
- https://github.com/cloudreve/cloudreve Product
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-862Missing Authorization
Timeline
Published22 Sep 2026
Updated19 Oct 2026
First seen22 Sep 2026
Sources
CVE-2026-77637 · NVD
CVE-2026-77637 · MITRE
GHSA-w89x-c962-c44g · GHSA
CVE-2026-77637 · OSV
GHSA-w89x-c962-c44g · OSV
Track software like this
Free during beta