Low severity3.8NVD Advisory· Published Sep 22, 2026· Updated Sep 22, 2026
CVE-2026-77637
CVE-2026-77637
Description
Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, tool.GET("wopi") and tool.POST("mail") in routers/router.go inherit ScopeAdminRead but omit the RequiredScopes(types.ScopeAdminWrite) middleware applied to neighboring state-changing admin tool routes. An OAuth application or API key limited to Admin.Read can therefore probe configured WOPI service endpoints and send arbitrary test email through the server SMTP configuration, exceeding the token's intended read-only authorization boundary. This issue is fixed in version 4.18.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/cloudreve/Cloudreve/v4Go | < 4.0.0-20260715070110-bce08f88e9d8 | 4.0.0-20260715070110-bce08f88e9d8 |
Affected products
1Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-w89x-c962-c44gghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-77637ghsaADVISORY
- github.com/cloudreve/cloudreve/commit/bce08f88e9d8f881e78fd18e7a6598b31922c492nvdWEB
- github.com/cloudreve/cloudreve/releases/tag/4.18.0nvdWEB
- github.com/cloudreve/cloudreve/security/advisories/GHSA-w89x-c962-c44gnvdWEB
News mentions
0No linked articles in our index yet.