EUVD-2026-87979
GHSA-pg9h-w4pm-q3vr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain admin-granted Admin.Read OAuth token
-
ExploitPOST crafted node definition to /admin/node/test
-
ExecutionServer issues outbound request to attacker URL
-
ImpactProbe internal services / blind SSRF
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires that an administrator has already authorized an OAuth client with the Admin.Read scope; the attacker must control that client's access token. No Admin.Write scope, and no admin credentials, are needed - that missing scope check on POST /api/v4/admin/node/test and /api/v4/admin/node/test/downloader is the entire flaw. Affects Cloudreve before 4.17.0 (verified through tag 4.16.1 / commit ba2e870b). The primary limiting factor is the prerequisite Admin.Read OAuth grant, which constrains this to environments that expose OAuth-authorized admin clients rather than default standalone deployments; impact is bounded to blind SSRF and internal probing (no direct data read-back). |
| Impact | This is a genuine but modest-severity authorization flaw (CWE-863), consistent with its 5.3 medium rating. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L) is well-supported by the advisory: exploitation is remote and low-complexity but requires an already-authorized OAuth token (PR:L), and impact is limited (blind SSRF with low confidentiality and low availability effect, no integrity impact). No EPSS score was provided, it is NOT in CISA KEV, and no public POC is referenced - the GHSA contains detailed reproduction steps but a working prerequisite (an admin must first authorize an OAuth client with Admin.Read) meaningfully limits mass exploitation. All signals align: this is a real, patch-worthy issue but a targeted/low-urgency one, not a high-priority emergency. It is a legitimate medium-CVSS issue rather than inflated or downplayed. The one nuance worth verifying is scope: SSRF that pivots to internal services can arguably warrant a scope change, but the vendor kept subsequent-system metrics at N (SC/SI/SA:N) treating the blind SSRF as bounded to the Cloudreve host's own outbound behavior. |
| Exploit ScenarioDerived | An administrator authorizes a third-party OAuth client with only the Admin.Read scope (a seemingly low-risk, read-only grant). The attacker controlling that client calls POST /api/v4/admin/node/test with a crafted node definition whose server URL points at an internal service (e.g. cloud metadata endpoints or an internal admin panel), causing the Cloudreve server to issue outbound signed slave-style requests to that target. Detailed reproduction steps are published in the GHSA advisory, though no standalone weaponized POC is referenced. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 27, 2026
Cloudreve before 4.17.0 applies only the Admin.Read OAuth scope to the admin node test endpoints (POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader), while the sibling node create, update, and delete routes correctly demand Admin.Write. An authenticated holder of an admin-authorized OAuth token carrying only Admin.Read can therefore submit crafted node definitions and force the Cloudreve server to make outbound requests to arbitrary URLs, yielding blind server-side request forgery, internal service probing, and delivery of signed Cloudreve slave-style requests to attacker-chosen hosts; because the responses are not returned to the caller, impact is limited to blind SSRF and availability-adjacent network effects rather than direct data disclosure. No public exploit code was identified at time of analysis, exploitation is not confirmed in CISA KEV, and the practical prerequisite is an environment where an administrator has granted an OAuth client the Admin.Read scope - a real but bounded prerequisite that is consistent with the medium (5.3) severity rating and the authenticated (PR:L) nature of the flaw. The vendor has released a patch in 4.17.0 and upstream fix commit 332a9d800205082a2469e555fd66a63f18d9d5dc.
RemediationAI
Primary fix: upgrade to Cloudreve 4.17.0, which corrects the missing Admin.Write scope enforcement on the node test routes. Builders consuming the Go module should move to github.com/cloudreve/Cloudreve/v4 at 4.0.0-20260626022735-332a9d800205 or later, which corresponds to upstream commit https://github.com/cloudreve/cloudreve/commit/332a9d800205082a2469e555fd66a63f18d9d5dc; the v3 module line (<= 3.0.0-20250225100611-da4e44b77af4) has no fixed version recorded, so v3 operators should either migrate to v4 4.17.0+ or apply compensating controls. Refer to the vendor advisory https://github.com/cloudreve/cloudreve/security/advisories/GHSA-v6w6-358x-2433 and the VulnCheck advisory https://www.vulncheck.com/advisories/cloudreve-before-4.17.0-ssrf-via-admin-read-oauth-scope for the authoritative fix guidance. Because the flaw is a scope-mapping defect rather than a patchable input-validation bug, practical mitigations until upgrade are: audit and revoke any OAuth client grants carrying Admin.Read that are not strictly required, and avoid issuing Admin.Read tokens to third-party or semi-trusted clients, accepting that this reduces the usability of legitimate read-only integrations; restrict the Cloudreve process's outbound egress with firewall or egress-proxy rules that deny access to loopback, RFC1918, and link-local/cloud metadata ranges (169.254.0.0/16) while still permitting traffic to legitimate slave-node addresses, with the trade-off that overly broad blocking will break node connectivity and downloader tests; and monitor Cloudreve server logs for unexpected POSTs to /api/v4/admin/node/test and /api/v4/admin/node/test/downloader, plus for outbound requests to internal address space, as a detection control that does not prevent but does surface abuse.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-863 (Incorrect Authorization): a middleware scope check is applied inconsistently across an otherwise uniformly protected administrative route group. Cloudreve's v4 admin router applies LoginRequired() and RequiredScopes(types.ScopeAdminRead) to the whole group, then registers node test endpoints without an additional RequiredScopes(types.ScopeAdminWrite) guard, unlike node PUT/PUT :id/DELETE :id which explicitly add ScopeAdminWrite. The two exposed handlers are AdminTestSlave (backed by adminsvc.TestNodeService) and AdminTestDownloader (backed by adminsvc.TestNodeDownloaderService). TestNodeService.Test() calls url.Parse on the attacker-supplied service.Node.Server value and then issues an HTTP POST to routes.SlavePingRoute(slave), constructing a signed Cloudreve slave-style request; TestNodeDownloaderService.Test() builds a downloader object from attacker-controlled node settings and invokes its network test method. OAuth is the relevant protocol surface: Cloudreve authorizes third-party clients with discrete scopes (e.g., 'openid Admin.Read'), so the defect is a missing scope-to-capability mapping rather than a memory-safety or injection bug. Any outbound HTTP client reachable by the Cloudreve process - including loopback, RFC1918 ranges, link-local/cloud metadata addresses, and internal administrative services - becomes reachable through the server's network position, but the SSRF is blind because neither handler returns the remote response body to the caller. The CPE cpe:2.3:a:cloudreve:cloudreve:*:*:*:*:*:*:*:* reflects an unversioned wildcard, so operators must rely on version comparison (< 4.17.0, verified through tag 4.16.1 and master commit ba2e870bbd17f1918dd2321de861e453f696d6a3) rather than CPE-based matching. A separate Go module entry for github.com/cloudreve/Cloudreve/v3 is listed as vulnerable at <= 3.0.0-20250225100611-da4e44b77af4 with no fixed version recorded, indicating the v3 line has not received an equivalent upstream fix.
Know when Cloudreve gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
Remote, low-complexity call needing a pre-authorized Admin.Read OAuth token (PR:L); blind SSRF yields limited confidentiality and availability impact, no integrity impact, matching vendor's no-scope-change choice.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Cloudreve before 4.17.0 registers the administrative node test endpoints (POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader) without requiring the Admin.Write OAuth scope, unlike the node create/update/delete routes. An OAuth client that has been authorized by an administrator with only the Admin.Read scope can therefore submit attacker-controlled node definitions and cause the Cloudreve server to issue outbound requests to arbitrary URLs, enabling blind server-side request forgery, internal service probing, and delivery of signed Cloudreve slave-style requests to attacker-chosen endpoints.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Concurrent upload-session requests in Cloudreve prior to 4.18.0 allow an authenticated user holding Files.Write permissi
Cloudreve versions v1.0.0 through v3.5.3 are vulnerable to Stored Cross-Site Scripting (XSS), via the file upload functi
Privilege escalation via OAuth scope enforcement bypass affects Cloudreve self-hosted file management versions 4.12.0 th
Path traversal via improper authorization in Cloudreve's WebDAV handler lets a scoped WebDAV account escape its configur
Revoked, expired, or download-limit-exhausted Cloudreve shares can still be mined for signed file URLs for up to 300 sec
Server-side request forgery in Cloudreve prior to 4.18.0 allows an authenticated user with remote-download privileges to
Server-Side Request Forgery in Cloudreve's remote download workflow (versions prior to 4.16.1) enables authenticated use
Cloudreve instances running versions prior to 4.18.0 fail to enforce write-scope authorization on two admin tool routes,
Path traversal in Cloudreve before 4.16.1 lets an authenticated user write downloaded files outside the destination dire
Exploit-DB