Cloudreve (>= 4.0.0-20260114075425-Bc6845bd742c, < 4.0.0-20260606015557-Ed20843dc3df)

Cloudreve's OAuth implementation contains a vulnerability, CVE-2026-54560, where OAuth access tokens bypass intended scope enforcement due to a missing `client_id` claim, allowing an attacker with a low-scope token to access sensitive APIs requiring higher privileges, effectively leading to privilege escalation.