CVE-2026-77637: Cloudreve Auth Bypass Vulnerability

CVE-2026-77637 Overview

Cloudreve is a self-hosted file management and sharing system. CVE-2026-77637 is a missing authorization flaw [CWE-862] affecting Cloudreve versions prior to 4.18.0. The tool.GET("wopi") and tool.POST("mail") routes in routers/router.go inherit the ScopeAdminRead scope but omit the RequiredScopes(types.ScopeAdminWrite) middleware applied to neighboring state-changing admin routes. An OAuth application or API key restricted to Admin.Read can therefore probe configured Web Application Open Platform Interface (WOPI) service endpoints and dispatch arbitrary test emails through the server SMTP configuration. The issue is fixed in version 4.18.0.

Critical Impact
Read-scoped API tokens can exceed their authorization boundary to send arbitrary test emails via the server SMTP configuration and enumerate WOPI service endpoints.

Affected Products

Cloudreve versions prior to 4.18.0
routers/router.go admin tool route group
Deployments issuing OAuth applications or API keys scoped to Admin.Read

Discovery Timeline

2026-09-22 - CVE-2026-77637 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-77637

Vulnerability Analysis

Cloudreve enforces admin API authorization through scope middleware attached to route groups. State-changing admin tool routes require the ScopeAdminWrite scope in addition to the group-inherited ScopeAdminRead. The tool.GET("wopi") handler, which fetches a WOPI discovery document from a caller-supplied URL, and tool.POST("mail"), which sends a test email using the configured SMTP settings, were registered without the RequiredScopes(types.ScopeAdminWrite) middleware.

A caller holding a token limited to Admin.Read can invoke both endpoints. The WOPI fetch enables server-side probing of arbitrary URLs supplied via query parameters, exposing internal WOPI endpoints. The mail endpoint allows a read-only token to trigger outbound SMTP traffic from the Cloudreve server. This exceeds the token's intended read-only authorization boundary.

Root Cause

The root cause is missing function-level authorization [CWE-862] on two admin tool routes. Neighboring routes correctly required ScopeAdminWrite, but the WOPI and mail test routes were registered without that scope enforcement, relying only on the group-inherited read scope.

Attack Vector

An authenticated attacker with a compromised or intentionally issued read-only admin token sends HTTP requests to /api/admin/tool/wopi or /api/admin/tool/mail. No user interaction is required. The attacker gains SMTP-backed message dispatch and server-side URL fetching against WOPI endpoints, both of which should be gated behind write privileges.

				tool := admin.Group("tool")
				{
					tool.GET("wopi",
+						middleware.RequiredScopes(types.ScopeAdminWrite),
						controllers.FromQuery[adminsvc.FetchWOPIDiscoveryService](adminsvc.FetchWOPIDiscoveryParamCtx{}),
						controllers.AdminFetchWopi,
					)

Source: Cloudreve commit bce08f8 — the patch adds RequiredScopes(types.ScopeAdminWrite) to the affected tool routes.

Detection Methods for CVE-2026-77637

Indicators of Compromise

Requests to /api/admin/tool/wopi or /api/admin/tool/mail originating from OAuth applications or API keys scoped only to Admin.Read.
Unexpected outbound SMTP traffic from the Cloudreve host triggered by test-mail requests.
WOPI discovery fetches targeting unusual or internal URLs supplied via query parameters.

Detection Strategies

Review Cloudreve access logs for hits on the admin tool/wopi and tool/mail endpoints and correlate the requesting token's granted scopes.
Compare the token identifier used in each admin tool request against the authorization scope list stored for that token.
Alert on any successful HTTP 2xx response to these routes when the calling token lacks Admin.Write.

Monitoring Recommendations

Enable audit logging of admin API calls, including caller identity, token ID, and granted scopes.
Monitor egress SMTP connections from the Cloudreve server and baseline expected volume.
Track outbound HTTP requests initiated by the WOPI discovery handler to detect internal network probing.

How to Mitigate CVE-2026-77637

Immediate Actions Required

Upgrade Cloudreve to version 4.18.0 or later, which applies RequiredScopes(types.ScopeAdminWrite) to the affected routes.
Rotate any OAuth application secrets and API keys that were issued with Admin.Read scope during the vulnerable period.
Audit historical access logs for prior invocations of /api/admin/tool/wopi and /api/admin/tool/mail by read-only tokens.

Patch Information

The fix is included in Cloudreve 4.18.0. Refer to the GitHub Security Advisory GHSA-w89x-c962-c44g, the GitHub Release 4.18.0 notes, and the upstream commit for details.

Workarounds

Restrict issuance of Admin.Read OAuth applications and API keys until the upgrade to 4.18.0 is complete.
Place a reverse proxy in front of Cloudreve that blocks unauthenticated or read-scoped access to /api/admin/tool/wopi and /api/admin/tool/mail.
Disable SMTP configuration on the Cloudreve server if outbound mail is not required, eliminating abuse of the test-mail path.

bash

# Example reverse-proxy rule to block the affected admin tool routes
location ~ ^/api/admin/tool/(wopi|mail)$ {
    return 403;
}