CVE-2026-54560

Deferred Deferred - Pending Action

OAuth Token Scope Bypass in Cloudreve

Publication date: 2026-07-15

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description

Cloudreve is a self-hosted file management and sharing system. From 4.12.0 until 4.16.1, Cloudreve's OAuth access tokens are issued without the OAuth client_id claim, so the JWT verifier does not load token scopes into request context and RequiredScopes treats the request like non-scoped session authentication, allowing a low-scope OAuth access token to call APIs requiring higher scopes such as file, share, workflow, user setting, WebDAV account, and potentially admin scopes. This issue is fixed in version 4.16.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-15

Generated

2026-08-04

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-54560

EUVD

EUVD-2026-44689

Affected Vendors & Products

Vendor	Product	Version / Range
cloudreve	cloudreve	From 4.12.0 (inc) to 4.16.1 (inc)
cloudreve	cloudreve	4.16.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

Cloudreve versions 4.12.0 to 4.16.1 have a flaw where OAuth access tokens are issued without the client_id claim in JWT tokens. This causes the system to ignore scope restrictions, allowing tokens with low privileges to access APIs requiring higher scopes.

Detection Guidance

To detect this vulnerability, check Cloudreve versions between 4.12.0 and 4.16.0. Verify if OAuth access tokens lack the client_id claim in JWT tokens. Inspect token generation logs for missing ClientID field in IssueTokenArgs. Compare token contents against the fixed version 4.16.1.

Impact Analysis

An attacker could use a low-privilege OAuth token to access sensitive APIs like file operations, shares, workflows, user settings, WebDAV accounts, or even admin functions if the user is an administrator. This bypasses intended access controls.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating principles of least privilege and data protection required by GDPR and HIPAA. Unauthorized access to user settings or admin functions may result in data breaches or non-compliance with regulatory requirements.

Mitigation Strategies

Upgrade Cloudreve to version 4.16.1 or later to apply the fix for missing client_id in OAuth tokens.

Review OAuth token scopes and ensure proper enforcement by verifying client_id is included in access tokens.

Hi! I’m here to help you understand CVE-2026-54560. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70