All vulnerabilities
CVE-2026-101048GHSA-v6w6-358x-2433GO-2026-6106

Cloudreve before 4.17.0 SSRF via Admin.Read OAuth scope

cloudreve cloudreveGoLibraries & packages
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 30 Sep 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.19%Chance of exploitation activity in the next 30 days, higher than 7% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.17.0Also 4.0.0-20260626022735-332a9d800205CVE List
Published27 Sep 2026Updated 8 Oct 2026CVE List

What fixes it

  • 4.17.0cloudreveCVE List
  • 4.0.0-20260626022735-332a9d800205github.com/cloudreve/Cloudreve/v4, GoOSVgo get github.com/cloudreve/Cloudreve/v4@v4.0.0-20260626022735-332a9d800205

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Cloudreve before 4.17.0 registers the administrative node test endpoints (POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader) without requiring the Admin.Write OAuth scope, unlike the node create/update/delete routes. An OAuth client that has been authorized by an administrator with only the Admin.Read scope can therefore submit attacker-controlled node definitions and cause the Cloudreve server to issue outbound requests to arbitrary URLs, enabling blind server-side request forgery, internal service probing, and delivery of signed Cloudreve slave-style requests to attacker-chosen endpoints.

Text from CVE List

Affected versions 4

  • cloudreveaffected: all versions before 4.17.0CVE List
  • cloudreveunaffected: 4.17.0CVE List
  • github.com/cloudreve/Cloudreve/v4, Gofrom first release, fixed in 4.0.0-20260626022735-332a9d800205OSV
  • github.com/cloudreve/Cloudreve/v3, Gofrom first release, through 3.0.0-20250225100611-da4e44b77af4OSV

References 2