Cloudreve v4 has a vulnerability where two admin node test endpoints under the Admin.Read OAuth scope accept attacker-controlled node definitions and cause the server to make outbound network requests. Although node create, update, and delete routes require Admin.Write scope, these test endpoints do not, allowing an attacker with only Admin.Read scope to trigger server-side requests to arbitrary URLs. This was confirmed on version 4.16.1 and the latest master commit. The issue arises because the route group enforces Admin.Read by default and relies on per-route Admin.Write middleware for state-mutating operations, but the test endpoints were omitted from this stricter scope requirement. The vulnerability enables blind SSRF, internal service probing, and triggering signed requests to attacker-chosen endpoints.

An attacker who obtains an OAuth token with only Admin.Read scope can cause the Cloudreve server to connect to arbitrary URLs specified in the request body via the node test endpoints. This allows blind server-side request forgery (SSRF), internal network reconnaissance, and potentially triggering signed Cloudreve slave-style requests to endpoints controlled by the attacker. The attacker cannot perform node create, update, or delete operations without Admin.Write scope, but can still cause operational network actions that should be restricted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The recommended remediation is to add Admin.Write scope enforcement middleware to the node test endpoints to prevent Admin.Read-only tokens from triggering server-side network requests. Additionally, applying SSRF validation or network egress controls on all admin-supplied test URLs is advised. Auditing other admin test endpoints for similar read-scoped side effects is also recommended.