CVE-2026-77637

Published: Sep 22, 2026Modified: Sep 22, 2026Deferred

3.8

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Exploitability: 1.2 / Impact: 2.5

Source: security-advisories@github.com (Secondary)

Description

Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, tool.GET("wopi") and tool.POST("mail") in routers/router.go inherit ScopeAdminRead but omit the RequiredScopes(types.ScopeAdminWrite) middleware applied to neighboring state-changing admin tool routes. An OAuth application or API key limited to Admin.Read can therefore probe configured WOPI service endpoints and send arbitrary test email through the server SMTP configuration, exceeding the token's intended read-only authorization boundary. This issue is fixed in version 4.18.0.

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (3)

https://github.com/cloudreve/cloudreve/commit/bce08f88e9d8f881e78fd18e7a6598b31922c492

Source: security-advisories@github.com

https://github.com/cloudreve/cloudreve/releases/tag/4.18.0

Source: security-advisories@github.com

https://github.com/cloudreve/cloudreve/security/advisories/GHSA-w89x-c962-c44g

Source: security-advisories@github.com

Timeline

No history available yet.