CVE-2026-101048
Deferred Deferred - Pending Action

Blind SSRF in Cloudreve via OAuth Admin.Read Scope

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: VulnCheck

Description
Cloudreve before 4.17.0 registers the administrative node test endpoints (POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader) without requiring the Admin.Write OAuth scope, unlike the node create/update/delete routes. An OAuth client that has been authorized by an administrator with only the Admin.Read scope can therefore submit attacker-controlled node definitions and cause the Cloudreve server to issue outbound requests to arbitrary URLs, enabling blind server-side request forgery, internal service probing, and delivery of signed Cloudreve slave-style requests to attacker-chosen endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-27
Last Modified
2026-09-27
Generated
2026-09-27
AI Q&A
2026-09-27
EPSS Evaluated
N/A
NVD
CVE-2026-101048
EUVD
EUVD-2026-87979

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cloudreve cloudreve to 4.17.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Cloudreve before version 4.17.0 has an authorization flaw where two administrative endpoints (POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader) do not require the Admin.Write OAuth scope. This allows attackers with only the Admin.Read scope to submit malicious node definitions, forcing the server to make outbound requests to arbitrary URLs. This enables blind Server-Side Request Forgery (SSRF), internal service probing, and delivery of signed requests to attacker-chosen endpoints.

Detection Guidance

Check Cloudreve server logs for suspicious outbound requests from the endpoints POST /api/v4/admin/node/test or POST /api/v4/admin/node/test/downloader. Monitor network traffic for unexpected connections to arbitrary URLs initiated by the Cloudreve process.

Impact Analysis

An attacker could exploit this to perform blind SSRF, probe internal services, or send signed requests to external endpoints. This could lead to data exfiltration, unauthorized access to internal systems, or further attacks leveraging the Cloudreve server as a proxy. The impact depends on the server's network configuration and the privileges of the Cloudreve instance.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations using affected Cloudreve versions may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade Cloudreve to version 4.17.0 or later to patch the vulnerability. Review OAuth token scopes and ensure only Admin.Write tokens can access node test endpoints. Disable or restrict access to the vulnerable endpoints if immediate upgrade is not possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101048. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart