CVE-2026-77637

low

Cloudreve is a self-hosted file management and sharing system.

Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, tool.GET("wopi") and tool.POST("mail") in routers/router.go inherit ScopeAdminRead but omit the RequiredScopes(types.ScopeAdminWrite) middleware applied to neighboring state-changing admin tool routes. An OAuth application or API key limited to Admin.Read can therefore probe configured WOPI service endpoints and send arbitrary test email through the server SMTP configuration, exceeding the token's intended read-only authorization boundary. This issue is fixed in version 4.18.0.

CVSS

3.8

3.8 (CVSS v3.1)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Severity source: NVD CVSS v3.1 (security-advisories@github.com)

Timeline (UTC)

Published: 2026-09-22 16:17

Modified: 2026-09-22 18:17

NVD status: Deferred

Last synced 3 days ago

Verified against the source API 2026-10-27 06:55 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

Not reported by the source (unknown — not "none").

Weakness classification (CWE)

CWE-862

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

No vendor advisory or patch reference tagged by NVD. Check the references below.

References

https://github.com/cloudreve/cloudreve/commit/bce08f88e9d8f881e78fd18e7a6598b31922c492 security-advisories@github.com
https://github.com/cloudreve/cloudreve/releases/tag/4.18.0 security-advisories@github.com
https://github.com/cloudreve/cloudreve/security/advisories/GHSA-w89x-c962-c44g security-advisories@github.com

Data sources

NVD CVE API 2.0 — fetched 2026-10-27 06:55 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores