CVE-2026-55502

Name of the Vulnerable Software and Affected Versions Cloudreve versions prior to 4.17.0

Description An OAuth scope authorization bypass exists in the admin storage policy routes. A user with an OAuth bearer token scoped only to Admin.Read can access the 'POST /api/v4/admin/policy/oauth/signin' endpoint, which lacks the Admin.Write guard required by other policy mutation routes. This allows an attacker to modify OneDrive storage policy credentials by supplying arbitrary secret and app id values, which are then persisted by the GetOauthRedirectService function. This can lead to the disruption of the storage backend or the redirection of future OAuth setups to attacker-controlled parameters.

Recommendations Update to version 4.17.0. As a temporary workaround, restrict access to the 'POST /api/v4/admin/policy/oauth/signin' endpoint to only those users with Admin.Write permissions.