CVE-2026-77637
Deferred Deferred - Pending Action

Stored XSS in Cloudreve File Management System

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description
Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, tool.GET("wopi") and tool.POST("mail") in routers/router.go inherit ScopeAdminRead but omit the RequiredScopes(types.ScopeAdminWrite) middleware applied to neighboring state-changing admin tool routes. An OAuth application or API key limited to Admin.Read can therefore probe configured WOPI service endpoints and send arbitrary test email through the server SMTP configuration, exceeding the token's intended read-only authorization boundary. This issue is fixed in version 4.18.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-77637
EUVD
EUVD-2026-84529

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
cloudreve cloudreve to 4.18.0 (exc)
cloudreve cloudreve 4.18.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Cloudreve before version 4.18.0 has an authorization bypass in admin tool routes. The tool.GET("wopi") and tool.POST("mail") endpoints incorrectly inherit only ScopeAdminRead permissions while neighboring state-changing routes require ScopeAdminWrite. This allows OAuth applications or API keys restricted to read-only access to perform unauthorized actions like probing WOPI endpoints or sending test emails via the server's SMTP configuration.

Detection Guidance

Check Cloudreve version with 'curl -s http://your-cloudreve-address/version' or 'docker inspect cloudreve | grep version'. If version is below 4.18.0, the system is vulnerable. Review OAuth app and API key permissions in Cloudreve admin panel to confirm if any have Admin.Read scope without Admin.Write restrictions.

Impact Analysis

If you use Cloudreve with OAuth or API keys limited to Admin.Read scope, an attacker could exploit this to send unauthorized emails through your server's SMTP configuration or probe WOPI service endpoints. This could lead to data leakage, spam, or unauthorized access to sensitive file operations.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized data access or transmission. GDPR may be impacted if personal data is exposed or processed without consent. HIPAA could be compromised if protected health information is sent via unauthorized emails. The unauthorized SMTP access may also violate data protection policies.

Mitigation Strategies

Upgrade Cloudreve to version 4.18.0 or later immediately. Review and revoke any OAuth apps or API keys with Admin.Read scope that do not require Admin.Write. Audit SMTP and WOPI service configurations for unauthorized access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77637. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart