CVE-2026-55502: Cloudreve Auth Bypass Vulnerability

CVE-2026-55502 Overview

CVE-2026-55502 is a broken access control vulnerability in Cloudreve, a self-hosted file management and sharing platform. The flaw affects versions prior to 4.17.0 and resides in the POST /api/v4/admin/policy/oauth/signin route. The endpoint requires only the Admin.Read scope, yet its handler persists caller-supplied OneDrive secret and app_id values into storage policy credentials. An OAuth token limited to Admin.Read can therefore modify storage configuration reserved for Admin.Write operations. The issue is tracked under CWE-863: Incorrect Authorization and is resolved in Cloudreve 4.17.0.

Critical Impact
An attacker holding a read-scoped admin OAuth token can overwrite OneDrive storage policy credentials, redirecting file storage to attacker-controlled infrastructure.

Affected Products

Cloudreve versions prior to 4.17.0
Cloudreve OneDrive storage policy integration
Cloudreve admin API surface (/api/v4/admin/policy/oauth/signin)

Discovery Timeline

2026-07-31 - CVE-2026-55502 published to NVD
2026-07-31 - Last updated in NVD database

Technical Details for CVE-2026-55502

Vulnerability Analysis

Cloudreve organizes its admin API behind a route group that enforces the Admin.Read scope. Sibling routes that mutate storage policies additionally attach a local Admin.Write guard. The OAuth sign-in route omits this second guard while still performing state-changing work.

The handler GetOauthRedirectService reads the caller-supplied secret and app_id parameters from the request body. It writes both values into the selected OneDrive storage policy before returning an OAuth redirect URL. The persistence step executes prior to any completion of the OAuth flow, so the attacker never needs to obtain a valid OneDrive token.

A compromised or over-scoped OAuth token limited to reading admin data therefore gains the ability to rewrite storage credentials. This breaks the tenant integrity model of the platform.

Root Cause

The root cause is inconsistent authorization enforcement across sibling routes. The OAuth sign-in handler was placed in an administrative group that grants read scope but was not annotated with the write-scope middleware applied to comparable policy mutation endpoints [CWE-863].

Attack Vector

Exploitation requires an authenticated OAuth token with the Admin.Read scope against a network-reachable Cloudreve instance. The attacker sends a POST request to /api/v4/admin/policy/oauth/signin with a target policy identifier and attacker-controlled secret and app_id values. The server persists the values into the selected OneDrive storage policy without further authorization checks. Subsequent file storage operations may resolve against attacker infrastructure or fail, depending on the substituted credentials.

See the GitHub Security Advisory GHSA-hq88-5x99-x3gf for the maintainer's technical description.

Detection Methods for CVE-2026-55502

Indicators of Compromise

Unexpected POST requests to /api/v4/admin/policy/oauth/signin originating from tokens that do not perform other write operations.
Modifications to OneDrive storage policy secret or app_id fields not correlated with an administrator-initiated configuration change.
OAuth redirect URLs generated for storage policies outside a scheduled reconfiguration window.

Detection Strategies

Audit Cloudreve access logs for calls to the OAuth sign-in route and correlate the caller's OAuth scope against subsequent policy field changes.
Compare current OneDrive storage policy credentials against a known-good configuration baseline stored outside the Cloudreve database.
Alert when storage policy rows are updated by API paths other than the sanctioned write endpoints.

Monitoring Recommendations

Forward Cloudreve application and reverse-proxy logs to a centralized log platform and retain admin API activity for forensic review.
Track OAuth token issuance and scope assignments to identify tokens with excessive lifetime or reuse across sessions.
Monitor outbound file transfer destinations for deviations from expected OneDrive tenants.

How to Mitigate CVE-2026-55502

Immediate Actions Required

Upgrade Cloudreve to version 4.17.0 or later, which adds the missing Admin.Write guard on the OAuth sign-in route.
Rotate OneDrive application secrets and app_id values used by any Cloudreve storage policy that ran on a vulnerable release.
Review and revoke unnecessary Admin.Read OAuth tokens, particularly long-lived integration tokens.
Verify OneDrive storage policy configuration against an authoritative baseline after upgrading.

Patch Information

The vulnerability is fixed in Cloudreve 4.17.0. The upstream advisory is published at GHSA-hq88-5x99-x3gf. Administrators should apply the upgrade before rotating credentials so that new secrets are not written through the vulnerable code path.

Workarounds

Restrict network access to /api/v4/admin/* routes to trusted administrative networks using a reverse proxy or firewall.
Limit issuance of Admin.Read OAuth tokens and reduce their validity period until the patch is deployed.
Disable OneDrive storage policies temporarily if the upgrade cannot be applied immediately.

bash

# Example reverse-proxy restriction (nginx) limiting admin routes to a trusted CIDR
location /api/v4/admin/ {
    allow 10.0.0.0/24;
    deny all;
    proxy_pass http://cloudreve_upstream;
}