CVE-2026-54560highCWE-863

CVE-2026-54560: high-severity vulnerability in cloudreve

Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim

Published

Follow this CVE+ Monitor cloudreve+ Monitor github.com/cloudreve/Cloudreve/v3

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.6epss 0.6%
Cloudreve is a self-hosted file management and sharing system. From 4.12.0 until 4.16.1, Cloudreve's OAuth access tokens are issued without the OAuth client_id claim, so the JWT verifier does not load token scopes into request context and RequiredScopes treats the request like non-scoped session authentication, allowing a low-scope OAuth access token to call APIs requiring higher scopes such as file, share, workflow, user setting, WebDAV account, and potentially admin scopes. This issue is fixed in version 4.16.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
Affected products
cloudreve · cloudreve
Related CVEs — cloudreve

In the same product, most dangerous first.

CVE-2026-55497MEDIUMCloudreve: Server crash through image decompression/pixel bomb in thumbnail & avatar decoding (DoS)EPSS 0.5%CVE-2026-79913MEDIUMCloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addressesEPSS 0.4%CVE-2026-54562MEDIUMCloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responsesEPSS 0.4%CVE-2026-25726HIGHCloudreve is vulnerable to Account Takeover via Weak Cryptographic Token Generation (Insecure PRNG Seeding)EPSS 0.4%CVE-2026-55495MEDIUMCloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner AccountEPSS 0.4%CVE-2026-77633HIGHCloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of serviceEPSS 0.4%