CVE-2026-54560 | Cloudreve is a self-hosted file management and sharing syste… | CVSS 7.6 HIGH

Description

Cloudreve is a self-hosted file management and sharing system. From 4.12.0 until 4.16.1, Cloudreve's OAuth access tokens are issued without the OAuth client_id claim, so the JWT verifier does not load token scopes into request context and RequiredScopes treats the request like non-scoped session authentication, allowing a low-scope OAuth access token to call APIs requiring higher scopes such as file, share, workflow, user setting, WebDAV account, and potentially admin scopes. This issue is fixed in version 4.16.1.

Metadata

CVE ID: CVE-2026-54560
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-06-15 19:04 UTC
Published: 2026-07-15 14:40 UTC
Last updated: 2026-07-15 15:16 UTC
Primary CWE: CWE-863
CWE-863: Incorrect Authorization
Vendor / Product: cloudreve / cloudreve
Sources: cve.org · NVD

Severity & Metrics

7.6 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
cloudreve	cloudreve	—	>= 4.12.0, < 4.16.1

Weakness (CWE)

CWE	Source	Description
CWE-863	cna	CWE-863: Incorrect Authorization

CVSS scores (1)

Score	Severity	Version	Source	Vector
7.6	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

References (3)

https://github.com/cloudreve/cloudreve/security/advisories/GHSA-vgj4-345g-jcf8 https://github.com/cloudreve/cloudreve/security/advisories/GHSA-vgj4-345g-jcf8
https://github.com/cloudreve/cloudreve/commit/ed20843dc3df20a25fcaf6b538647e11c4d68d87 https://github.com/cloudreve/cloudreve/commit/ed20843dc3df20a25fcaf6b538647e11c4d68d87
https://github.com/cloudreve/cloudreve/releases/tag/4.16.1 https://github.com/cloudreve/cloudreve/releases/tag/4.16.1