{"id":"CVE-2026-77637","kind":"vulnerability","aliases":["CVE-2026-77637","GHSA-w89x-c962-c44g","GO-2026-6576"],"related":[],"title":"Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope in github.com/cloudreve/Cloudreve","description":"Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, tool.GET(\"wopi\") and tool.POST(\"mail\") in routers/router.go inherit ScopeAdminRead but omit the RequiredScopes(types.ScopeAdminWrite) middleware applied to neighboring state-changing admin tool routes. An OAuth application or API key limited to Admin.Read can therefore probe configured WOPI service endpoints and send arbitrary test email through the server SMTP configuration, exceeding the token's intended read-only authorization boundary. This issue is fixed in version 4.18.0.","summary":"Cloudreve, a self-hosted file sharing system, exposes its WOPI probe and test-mail admin routes to tokens limited to read-only admin scope. An attacker holding such a token can probe configured WOPI endpoints and send arbitrary test email through the server's SMTP settings.","severity":"low","cvss":3.8,"epss":0.00326,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/cloudreve/Cloudreve","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/cloudreve/Cloudreve/v3","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/cloudreve/Cloudreve/v4","fixed":["4.0.0-20260715070110-bce08f88e9d8"],"affected":"< 4.0.0-20260715070110-bce08f88e9d8","ecosystem":"go"}],"ecosystems":["go"],"tags":["cloudreve","go","oauth","package","self-hosted"],"not_affected_if":["default-config","managed-hosting","no-admin-read-tokens"],"how_to_check":"Review OAuth applications and API keys issued with the Admin.Read scope in the Cloudreve admin panel.","fix":"Upgrade Cloudreve to 4.18.0 or later (govuln lists the pseudo-version 4.0.0-20260715070110-bce08f88e9d8 as the fixed version).\nRevoke or reissue any Admin.Read tokens that are not needed.","status":"open","published_at":"2026-09-22T16:17:55+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T21:49:16+00:00","updated_at":"2026-10-23T21:49:16+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T21:49:16Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Cloudreve to 4.18.0 or later (govuln lists the pseudo-version 4.0.0-20260715070110-bce08f88e9d8 as the fixed version).\nRevoke or reissue any Admin.Read tokens that are not needed.","reach":"internet","impact":"low","summary":"Cloudreve, a self-hosted file sharing system, exposes its WOPI probe and test-mail admin routes to tokens limited to read-only admin scope. An attacker holding such a token can probe configured WOPI endpoints and send arbitrary test email through the server's SMTP settings.","category":"package","who_cares":["cloudreve","self-hosted","go","oauth"],"confidence":0.7,"needs_auth":"yes","worst_case":"Read-only admin tokens can send test email and probe WOPI endpoints.","analyst_note":"Sources conflict on the fixed version (description says 4.18.0, govuln gives pseudo-version 4.0.0-20260715070110-bce08f88e9d8); confirm against the GHSA-w89x-c962-c44g advisory and the Cloudreve release notes.","how_to_check":"Review OAuth applications and API keys issued with the Admin.Read scope in the Cloudreve admin panel.\nunknown","needs_analyst":true,"not_affected_if":["no-admin-read-tokens","managed-hosting","default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000801,"input_tokens":3152,"output_tokens":971,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':22A,30A,33A '-6576':31A '-77637':23A,34A '/cloudreve/cloudreve':20A,37A '/cloudreve/cloudreve/v3':40A '/cloudreve/cloudreve/v4':43A '4.18.0':113C,180C 'access':10A 'admin':8A,67B,76B,135C 'admin.read':146C 'api':142C 'appli':129C 'applic':140C 'arbitrari':91B,156C 'attack':79B 'author':172C 'boundari':173C 'bypass':4A 'c44g':28A 'c962':27A 'chang':134C 'cloudrev':1A,44B,51B,100C 'configur':86B,150C,163C 'cve':21A,32A 'email':93B,158C 'endpoint':88B,153C 'exceed':164C 'expos':59B 'file':56B,106C 'fix':177C 'ghsa':25A 'ghsa-w89x-c962-c44g':24A 'github.com':19A,36A,39A,42A 'github.com/cloudreve/cloudreve':18A,35A 'github.com/cloudreve/cloudreve/v3':38A 'github.com/cloudreve/cloudreve/v4':41A 'go':29A,45B 'hold':80B 'host':50B,55B,105C 'inherit':121C 'intend':168C 'issu':175C 'key':143C 'limit':71B,144C 'mail':66B,118C 'manag':107C 'middlewar':128C 'mutat':7A 'neighbor':131C 'oauth':15A,46B,139C 'omit':124C 'oper':9A 'packag':47B 'prior':111C 'privileg':2A 'probe':62B,85B,149C 'read':13A,74B,170C 'read-on':12A,73B,169C 'requiredscop':126C 'rout':68B,137C 'routers/router.go':120C 'scope':3A,16A,77B 'scopeadminread':122C 'self':49B,54B,104C 'self-host':48B,53B,103C 'send':90B,155C 'server':96B,161C 'servic':152C 'set':99B 'share':57B,109C 'smtp':98B,162C 'state':6A,133C 'state-chang':132C 'state-mut':5A 'system':58B,110C 'test':65B,92B,157C 'test-mail':64B 'therefor':148C 'token':70B,83B,166C 'tool':136C 'tool.get':114C 'tool.post':117C 'types.scopeadminwrite':127C 'version':179C 'via':11A 'w89x':26A 'wopi':61B,87B,115C,151C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-22T16:17:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6576","url":"https://pkg.go.dev/vuln/GO-2026-6576","severity":null,"published_at":"2026-10-01T20:23:38+00:00","modified_at":"2026-10-01T20:23:38+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-77637","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77637","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-77637","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77637","severity":null,"published_at":"2026-09-22T16:17:55+00:00","modified_at":"2026-09-22T18:17:19+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}