---
id: "CVE-2026-77637"
kind: "vulnerability"
aliases: ["CVE-2026-77637", "GHSA-w89x-c962-c44g", "GO-2026-6576"]
title: "Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope in github.com/cloudreve/Cloudreve"
severity: "low"
cvss: 3.8
epss: 0.00326
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/cloudreve/Cloudreve", "fixed": [], "affected": "all versions", "ecosystem": "go"}, {"name": "github.com/cloudreve/Cloudreve/v3", "fixed": [], "affected": "all versions", "ecosystem": "go"}, {"name": "github.com/cloudreve/Cloudreve/v4", "fixed": ["4.0.0-20260715070110-bce08f88e9d8"], "affected": "< 4.0.0-20260715070110-bce08f88e9d8", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["cloudreve", "go", "oauth", "package", "self-hosted"]
not_affected_if: ["default-config", "managed-hosting", "no-admin-read-tokens"]
published_at: "2026-09-22T16:17:55+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T21:49:16+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6576", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-77637", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77637", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope in github.com/cloudreve/Cloudreve

Cloudreve, a self-hosted file sharing system, exposes its WOPI probe and test-mail admin routes to tokens limited to read-only admin scope. An attacker holding such a token can probe configured WOPI endpoints and send arbitrary test email through the server's SMTP settings.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/cloudreve/Cloudreve affected all versions fixed ?
- go:github.com/cloudreve/Cloudreve/v3 affected all versions fixed ?
- go:github.com/cloudreve/Cloudreve/v4 affected < 4.0.0-20260715070110-bce08f88e9d8 fixed 4.0.0-20260715070110-bce08f88e9d8

## How to check

Review OAuth applications and API keys issued with the Admin.Read scope in the Cloudreve admin panel.

## Fix

Upgrade Cloudreve to 4.18.0 or later (govuln lists the pseudo-version 4.0.0-20260715070110-bce08f88e9d8 as the fixed version).
Revoke or reissue any Admin.Read tokens that are not needed.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6576
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-77637
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-77637

## From the sources

Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, tool.GET("wopi") and tool.POST("mail") in routers/router.go inherit ScopeAdminRead but omit the RequiredScopes(types.ScopeAdminWrite) middleware applied to neighboring state-changing admin tool routes. An OAuth application or API key limited to Admin.Read can therefore probe configured WOPI service endpoints and send arbitrary test email through the server SMTP configuration, exceeding the token's intended read-only authorization boundary. This issue is fixed in version 4.18.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_