Cloudreve CVE-2026-77637

Exploitation requires the attacker to already possess a valid credential - an OAuth application or API key - scoped to Admin.Read on a Cloudreve instance prior to 4.18.0; this is the concrete limiting factor (PR:H). Given such a token, no further conditions or user interaction are needed: the wopi GET and mail POST tool routes lack the AdminWrite scope enforcement, so the read-only token can probe configured WOPI service endpoints and send arbitrary test email via the server's SMTP settings. Impact is bounded to information probing and SMTP misuse; there is no code execution, no data-at-rest disclosure, and no availability impact. The realistic exposure is limited to environments that provision narrowly-scoped admin API tokens and treat Admin.Read as a genuine read-only boundary.

This is a genuinely low-priority issue whose signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N, base 3.8) correctly reflects a network-reachable but privilege-gated flaw: exploitation requires the attacker to already hold a valid, admin-scoped credential (an OAuth application or API key granted Admin.Read), which is why PR is High despite the read-only intent. No EPSS score, no CISA KEV entry, and no public POC were supplied, so there is no evidence of exploitation interest - and the SSVC-relevant technical impact is Partial at most (WOPI endpoint probing plus arbitrary test-email through the configured SMTP server, no data-at-rest confidentiality, no availability loss). The nature of the bug is a scope-confusion/authorization gap (CWE-862), not an authentication bypass: the token authenticates normally and is simply permitted actions beyond its intended read-only boundary. There are no conflicting signals in the input; the main caveat is that the Tags label this 'Authentication Bypass,' which misstates the mechanism. Overall this is a high-CVSS-is-not-the-case scenario - it is correctly scored low and should be treated as routine patch hygiene, not an urgent response item.

An operator issues an OAuth application or API key scoped only to Admin.Read (e.g., for a read-only monitoring integration), assuming it cannot change server state. Because the wopi GET and mail POST tool routes omit the AdminWrite scope check, the token holder invokes them to enumerate configured WOPI service endpoints and trigger arbitrary test emails through the server's SMTP configuration - actions that should require write privileges. No public exploit code was identified; exploitation is trivial for anyone already possessing such a scoped token.