Cloudreve's WOPI integration generates access tokens composed of a session ID and a 128-character random secret suffix. However, the middleware responsible for validating these tokens only verifies the session ID prefix and does not compare the full token against the stored secret. Consequently, any token suffix is accepted for a valid session ID. Furthermore, the WOPI viewer session does not enforce the requested viewer action (view vs. edit), allowing sessions created for viewing to invoke write endpoints if the file system permissions permit. This vulnerability was confirmed on Cloudreve v4.16.1 and the latest master commit. Exploitation allows an attacker with knowledge of a valid session ID to read and write files without proper authorization.

An attacker who obtains or guesses a valid WOPI session ID can bypass the intended access token protection and perform unauthorized file modifications through the WOPI write API endpoints. This breaks the expected access control model where view-only sessions should not have write capabilities. The vulnerability affects deployments using WOPI viewers for user files and can lead to unauthorized data tampering. The impact is limited to users with at least some privileges to create WOPI sessions and depends on file system write permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to WOPI session IDs and URLs to trusted parties only. Monitor for suspicious WOPI write activity and consider disabling WOPI write endpoints if not required. Review file permissions to minimize writable files accessible via WOPI. Follow official Cloudreve advisories for updates and patches addressing this vulnerability.