{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/cloudreve-v4/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Cloudreve (v4)","Cloudreve (v3)"],"_cs_severities":["high"],"_cs_tags":["authorization-bypass","cloudreve","oauth","web-vulnerability","credential-manipulation"],"_cs_type":"advisory","_cs_vendors":["Cloudreve"],"content_html":"\u003cp\u003eA critical authorization bypass vulnerability, identified as CVE-2026-55502, has been discovered in Cloudreve versions \u0026lt; 4.0.0-20260613030954-9e9fb43e7288 and \u0026lt;= 3.0.0-20250225100611-da4e44b74af4. This flaw allows an OAuth bearer token scoped to \u003ccode\u003eAdmin.Read\u003c/code\u003e, but explicitly lacking \u003ccode\u003eAdmin.Write\u003c/code\u003e permissions, to invoke \u003ccode\u003ePOST /api/v4/admin/policy/oauth/signin\u003c/code\u003e. This endpoint is intended for read-only administrative functions but fails to enforce the \u003ccode\u003eAdmin.Write\u003c/code\u003e guard present in other sensitive policy mutation routes. Attackers can exploit this to persistently modify the \u003ccode\u003esecret\u003c/code\u003e and \u003ccode\u003eapp_id\u003c/code\u003e associated with a configured OneDrive storage policy, potentially disrupting storage services, replacing legitimate application credentials, and redirecting future OAuth configurations to attacker-controlled parameters. The vulnerability highlights a breakdown in scope enforcement within Cloudreve's administrative API.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eA Cloudreve instance is configured with at least one OneDrive storage policy.\u003c/li\u003e\n\u003cli\u003eAn administrative user mistakenly or maliciously authorizes an OAuth client for \u003ccode\u003eAdmin.Read\u003c/code\u003e scope, but specifically does not grant \u003ccode\u003eAdmin.Write\u003c/code\u003e scope.\u003c/li\u003e\n\u003cli\u003eThe OAuth client successfully obtains a valid bearer access token for the admin user, constrained to \u003ccode\u003eAdmin.Read\u003c/code\u003e permissions.\u003c/li\u003e\n\u003cli\u003eThe attacker, leveraging the \u003ccode\u003eAdmin.Read\u003c/code\u003e token, crafts and sends an HTTP POST request to the vulnerable endpoint \u003ccode\u003e/api/v4/admin/policy/oauth/signin\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe POST request includes a JSON body containing attacker-controlled values for \u003ccode\u003eid\u003c/code\u003e, \u003ccode\u003esecret\u003c/code\u003e (e.g., \u0026quot;attacker-secret\u0026quot;), and \u003ccode\u003eapp_id\u003c/code\u003e (e.g., \u0026quot;attacker-app-id\u0026quot;).\u003c/li\u003e\n\u003cli\u003eDue to the absence of the intended \u003ccode\u003eAdmin.Write\u003c/code\u003e authorization guard, the Cloudreve application endpoint \u003ccode\u003econtrollers.AdminOdOAuthURL\u003c/code\u003e processes the request as if it were authorized.\u003c/li\u003e\n\u003cli\u003eThe underlying handler in \u003ccode\u003eservice/admin/policy.go\u003c/code\u003e persistently updates the selected OneDrive storage policy by replacing its \u003ccode\u003eSecretKey\u003c/code\u003e and \u003ccode\u003eBucketName\u003c/code\u003e (which maps to \u003ccode\u003eapp_id\u003c/code\u003e) with the attacker-supplied values.\u003c/li\u003e\n\u003cli\u003eThis action permanently modifies the storage backend configuration, breaking legitimate access, replacing critical application credentials, and redirecting all subsequent OAuth setups for that policy to parameters controlled by the attacker.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-55502 allows an unauthorized entity, possessing only read-level administrative OAuth access, to achieve significant control over OneDrive storage policies. This can lead to a complete disruption of the affected storage backend, rendering it inaccessible to legitimate users. The attacker can replace the genuine application secret and app ID, effectively hijacking the policy. Consequently, any future attempts to reconfigure or re-authenticate the OneDrive storage will be directed to attacker-controlled OAuth applications, leading to potential data exfiltration, service outages, or further compromise of integrated services. While no specific victim counts are provided, any Cloudreve installation using OneDrive storage policies with improperly scoped OAuth clients is at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-55502 immediately by upgrading Cloudreve to a version greater than or equal to 4.0.0-20260613030954-9e9fb43e7288 (for v4) or greater than 3.0.0-20250225100611-da4e44b7af4 (for v3).\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule in this brief to your SIEM to detect exploitation attempts of CVE-2026-55502 against the \u003ccode\u003ewebserver\u003c/code\u003e logs.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for any suspicious \u003ccode\u003ePOST\u003c/code\u003e requests to \u003ccode\u003e/api/v4/admin/policy/oauth/signin\u003c/code\u003e as identified in the Sigma rule, especially from OAuth clients with only \u003ccode\u003eAdmin.Read\u003c/code\u003e scope.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-24T20:50:35Z","date_published":"2026-07-24T20:50:35Z","id":"https://feed.craftedsignal.io/briefs/2026-07-cloudreve-oauth-bypass/","summary":"An authorization bypass vulnerability (CVE-2026-55502) in Cloudreve 4.16.1 allows an attacker with an `Admin.Read` OAuth token to modify the OneDrive storage policy credentials via a POST request to `/api/v4/admin/policy/oauth/signin`, despite lacking `Admin.Write` scope, which can break the storage backend and redirect future OAuth setups.","title":"Cloudreve OAuth Admin.Read Scope Bypass for OneDrive Storage Policy Credential Update (CVE-2026-55502)","url":"https://feed.craftedsignal.io/briefs/2026-07-cloudreve-oauth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cloudreve (V4)","version":"https://jsonfeed.org/version/1.1"}