{"cve":"CVE-2026-77637","nvd":{"published":"2026-09-22T16:17:55.990","modified":"2026-09-22T18:17:19.553","status":"Deferred","description":"Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, tool.GET(\"wopi\") and tool.POST(\"mail\") in routers/router.go inherit ScopeAdminRead but omit the RequiredScopes(types.ScopeAdminWrite) middleware applied to neighboring state-changing admin tool routes. An OAuth application or API key limited to Admin.Read can therefore probe configured WOPI service endpoints and send arbitrary test email through the server SMTP configuration, exceeding the token's intended read-only authorization boundary. This issue is fixed in version 4.18.0.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","score":3.8},"cwes":["CWE-862"],"references":["https://github.com/cloudreve/cloudreve/commit/bce08f88e9d8f881e78fd18e7a6598b31922c492","https://github.com/cloudreve/cloudreve/releases/tag/4.18.0","https://github.com/cloudreve/cloudreve/security/advisories/GHSA-w89x-c962-c44g"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:56:02.509636177+00:00"},"epss":{"cve":"CVE-2026-77637","score":0.00326,"percentile":0.25663,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-w89x-c962-c44g","url":"https://osv.dev/vulnerability/GHSA-w89x-c962-c44g","summary":"Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope","modified":"2026-10-01T20:56:21.389605829Z","packages":[{"ecosystem":"Go","name":"github.com/cloudreve/Cloudreve/v4","purl":"pkg:golang/github.com/cloudreve/Cloudreve/v4","ranges":["<4.0.0-20260715070110-bce08f88e9d8"],"fixed":["4.0.0-20260715070110-bce08f88e9d8"]}]},{"id":"GO-2026-6576","url":"https://osv.dev/vulnerability/GO-2026-6576","summary":"Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope in github.com/cloudreve/Cloudreve","modified":"2026-10-01T20:45:14.082193670Z","packages":[{"ecosystem":"Go","name":"github.com/cloudreve/Cloudreve","purl":"pkg:golang/github.com/cloudreve/Cloudreve","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/cloudreve/Cloudreve/v3","purl":"pkg:golang/github.com/cloudreve/Cloudreve/v3","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/cloudreve/Cloudreve/v4","purl":"pkg:golang/github.com/cloudreve/Cloudreve/v4","ranges":["<4.0.0-20260715070110-bce08f88e9d8"],"fixed":["4.0.0-20260715070110-bce08f88e9d8"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}