VulnerabilityPublished 07/24/2026

V4: Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests

Affects github.com/cloudreve/Cloudreve/v4Source GCVE Database

CVSS 3.1 base score

5.4Medium

Patch: Available – fixed in 4.0.0-20260626022735-332a9d800205

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

What to do

AI-suggested

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The recommended remediation is to add Admin.Write scope enforcement middleware to the node test endpoints to prevent Admin.Read-only tokens from triggering server-side network requests. Additionally, applying SSRF validation or network egress controls on all admin-supplied test URLs is advised. Auditing other admin test endpoints for similar read-scoped side effects is also recommended.

Affected software

Product	Affected	Fixed in
Gogithub.com/cloudreve/Cloudreve/v4	Affected <4.0.0-20260626022735-332a9d800205	Fixed in 4.0.0-20260626022735-332a9d800205
Gogithub.com/cloudreve/Cloudreve/v3	Affected <=3.0.0-20250225100611-da4e44b77af4	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

Cloudreve v4 exposes two admin node test endpoints that require only the Admin.Read OAuth scope but allow triggering server-side network requests to attacker-controlled URLs. This enables an attacker with an Admin.Read-only OAuth token to perform blind SSRF and internal service probing, actions that should require Admin.Write scope. The issue was verified in version 4.16.1 and the latest master commit. The root cause is missing Admin.Write scope enforcement on these test endpoints, which perform outbound network requests using attacker-supplied configuration.

Summary

Cloudreve v4 has a vulnerability where two admin node test endpoints under the Admin.Read OAuth scope accept attacker-controlled node definitions and cause the server to make outbound network requests. Although node create, update, and delete routes require Admin.Write scope, these test endpoints do not, allowing an attacker with only Admin.Read scope to trigger server-side requests to arbitrary URLs. This was confirmed on version 4.16.1 and the latest master commit. The issue arises because the route group enforces Admin.Read by default and relies on per-route Admin.Write middleware for state-mutating operations, but the test endpoints were omitted from this stricter scope requirement. The vulnerability enables blind SSRF, internal service probing, and triggering signed requests to attacker-chosen endpoints.

Impact

An attacker who obtains an OAuth token with only Admin.Read scope can cause the Cloudreve server to connect to arbitrary URLs specified in the request body via the node test endpoints. This allows blind server-side request forgery (SSRF), internal network reconnaissance, and potentially triggering signed Cloudreve slave-style requests to endpoints controlled by the attacker. The attacker cannot perform node create, update, or delete operations without Admin.Write scope, but can still cause operational network actions that should be restricted.

V4: Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests

What to do

Affected software

Description

Summary

Impact

Weaknesses

References

What to do

Affected software

Description

AnalysisAI-generated, updated 07/25/2026, 23:51:45 UTC

Technical details

Weaknesses

References

Related threats