CVE-2026-54560highCWE-863

CVE-2026-54560: fallo de gravedad alta en cloudreve

Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim

Publicada el

Seguir esta CVE+ Monitorear cloudreve+ Monitorear github.com/cloudreve/Cloudreve/v3

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.6epss 0.6%
Cloudreve is a self-hosted file management and sharing system. From 4.12.0 until 4.16.1, Cloudreve's OAuth access tokens are issued without the OAuth client_id claim, so the JWT verifier does not load token scopes into request context and RequiredScopes treats the request like non-scoped session authentication, allowing a low-scope OAuth access token to call APIs requiring higher scopes such as file, share, workflow, user setting, WebDAV account, and potentially admin scopes. This issue is fixed in version 4.16.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
Productos afectados
cloudreve · cloudreve
CVEs relacionadas — cloudreve

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-55497MEDIUMCloudreve: Server crash through image decompression/pixel bomb in thumbnail & avatar decoding (DoS)EPSS 0.5%CVE-2026-79913MEDIUMCloudreve: SSRF guard bypass: checkIP does not decode IPv6-transition wrappers (NAT64, IPv4-compatible, 6to4) reaching internal and cloud-metadata addressesEPSS 0.4%CVE-2026-54562MEDIUMCloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responsesEPSS 0.4%CVE-2026-25726HIGHCloudreve is vulnerable to Account Takeover via Weak Cryptographic Token Generation (Insecure PRNG Seeding)EPSS 0.4%CVE-2026-55495MEDIUMCloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner AccountEPSS 0.4%CVE-2026-77633HIGHCloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of serviceEPSS 0.4%