Live › vulnerability › CVE-2026-77637
Go to dashboardCloudreve, a self-hosted file sharing system, exposes its WOPI probe and test-mail admin routes to tokens limited to read-only admin scope. An attacker holding such a token can probe configured WOPI endpoints and send arbitrary test email through the server's SMTP settings.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| github.com/cloudreve/Cloudreve | go | all versions | – |
| github.com/cloudreve/Cloudreve/v3 | go | all versions | – |
| github.com/cloudreve/Cloudreve/v4 | go | < 4.0.0-20260715070110-bce08f88e9d8 | 4.0.0-20260715070110-bce08f88e9d8 |
Review OAuth applications and API keys issued with the Admin.Read scope in the Cloudreve admin panel.
4.18.0 or later (govuln lists the pseudo-version 4.0.0-20260715070110-bce08f88e9d8 as the fixed version)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, tool.GET("wopi") and tool.POST("mail") in routers/router.go inherit ScopeAdminRead but omit the RequiredScopes(types.ScopeAdminWrite) middleware applied to neighboring state-changing admin tool routes. An OAuth application or API key limited to Admin.Read can therefore probe configured WOPI service endpoints and send arbitrary test email through the server SMTP configuration, exceeding the token's intended read-only authorization boundary. This issue is fixed in version 4.18.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-77637")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.