CVE-2026-101048

Name of the Vulnerable Software and Affected Versions Cloudreve versions prior to 4.17.0

Description The software registers administrative node test endpoints that do not require the Admin.Write OAuth scope. This allows an OAuth client authorized only with the Admin.Read scope to submit attacker-controlled node definitions. This flaw enables blind server-side request forgery (SSRF)—a technique where an attacker forces a server to make requests to an unintended location—internal service probing, and the delivery of signed slave-style requests to arbitrary endpoints. The affected endpoints are 'POST /api/v4/admin/node/test' and 'POST /api/v4/admin/node/test/downloader'.

Recommendations Update to version 4.17.0 or later.