EUVD-2026-44689
GHSA-vgj4-345g-jcf8
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
Attacker needs a validly issued low-scope OAuth token (PR:L) and replays it over the network with no victim interaction (UI:N), gaining high-scope read/write within the same app (C:H/I:H, S:U).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Cloudreve is a self-hosted file management and sharing system. From 4.12.0 until 4.16.1, Cloudreve's OAuth access tokens are issued without the OAuth client_id claim, so the JWT verifier does not load token scopes into request context and RequiredScopes treats the request like non-scoped session authentication, allowing a low-scope OAuth access token to call APIs requiring higher scopes such as file, share, workflow, user setting, WebDAV account, and potentially admin scopes. This issue is fixed in version 4.16.1.
AnalysisAI
Privilege escalation via OAuth scope enforcement bypass affects Cloudreve self-hosted file management versions 4.12.0 through 4.16.0, where access tokens are issued without the client_id claim. Because the JWT verifier keys scope loading on client_id, a holder of a legitimately-issued low-scope OAuth access token can invoke APIs requiring higher scopes - file, share, workflow, user setting, WebDAV account, and potentially admin - as the enforcement layer degrades to non-scoped session authentication. No public exploit identified at time of analysis, but the root cause is confirmed by the vendor's fix commit and advisory GHSA-vgj4-345g-jcf8, with the issue resolved in 4.16.1.
Technical ContextAI
Cloudreve is a Go-based self-hosted file management and sharing platform using JWT-based authentication (pkg/auth/jwt.go). OAuth access tokens are minted as JWTs whose scopes are meant to constrain which API groups the bearer may call, enforced by a RequiredScopes middleware. The defect is a CWE-863 Incorrect Authorization: the token issuance path populated the JWT with Scopes but omitted the ClientID claim. On verification, the presence of a client_id is what signals the request as a scoped OAuth token and triggers loading of the token's scopes into request context; without it, the verifier never populates scopes and RequiredScopes treats the caller as an ordinary (fully-privileged) interactive session rather than a scope-limited OAuth client, effectively ignoring the scope ceiling. The one-line fix (adding ClientID: args.ClientID alongside Scopes in Issue()) restores the linkage so scopes are correctly loaded and enforced.
RemediationAI
Vendor-released patch: 4.16.1 - upgrade all affected Cloudreve instances (4.12.0 through 4.16.0) to 4.16.1 or later, which adds the missing ClientID claim so scopes are correctly loaded and enforced (fix commit ed20843dc3df20a25fcaf6b538647e11c4d68d87). Until you can upgrade, the most direct compensating control is to revoke all currently issued OAuth access tokens and refrain from issuing new OAuth tokens, since every token minted by an affected version lacks the client_id claim and will bypass scope enforcement; if OAuth-delegated access is not required, disable OAuth client access entirely to eliminate the low-privilege token path - the trade-off is loss of any third-party/delegated integrations relying on scoped tokens. Additionally restrict network exposure of the API to trusted clients where feasible. Reference the advisory at https://github.com/cloudreve/cloudreve/security/advisories/GHSA-vgj4-345g-jcf8 and release notes at https://github.com/cloudreve/cloudreve/releases/tag/4.16.1.
Cloudreve versions v1.0.0 through v3.5.3 are vulnerable to Stored Cross-Site Scripting (XSS), via the file upload functi
Path traversal via improper authorization in Cloudreve's WebDAV handler lets a scoped WebDAV account escape its configur
Server-Side Request Forgery in Cloudreve's remote download workflow (versions prior to 4.16.1) enables authenticated use
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today