{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/cloudreve/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.6,"id":"CVE-2026-54560"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Cloudreve (\u003e= 4.0.0-20260114075425-bc6845bd742c, \u003c 4.0.0-20260606015557-ed20843dc3df)"],"_cs_severities":["high"],"_cs_tags":["oauth","vulnerability","privilege-escalation","cloudreve","web-application"],"_cs_type":"advisory","_cs_vendors":["Cloudreve"],"content_html":"\u003cp\u003eA high-severity vulnerability, CVE-2026-54560, has been identified in Cloudreve versions \u003ccode\u003e\u0026gt;= 4.0.0-20260114075425-bc6845bd742c\u003c/code\u003e and \u003ccode\u003e\u0026lt; 4.0.0-20260606015557-ed20843dc3df\u003c/code\u003e, which allows OAuth access tokens to bypass intended scope enforcement. This flaw occurs because OAuth access tokens are issued without the \u003ccode\u003eclient_id\u003c/code\u003e claim. Consequently, Cloudreve's JWT verifier fails to load the specified scopes into the request context. The \u003ccode\u003eRequiredScopes(...)\u003c/code\u003e middleware then incorrectly treats these requests as non-scoped, session-based authentications, effectively skipping all scope checks. This enables an attacker, holding a legitimate but low-scope OAuth access token (e.g., granted only \u003ccode\u003eopenid\u003c/code\u003e), to access sensitive APIs that normally require higher privileges, such as file management, sharing, workflow controls, user settings, WebDAV account management, and potentially even administrative functions if the authorizing user possesses administrative rights. This vulnerability represents a significant privilege escalation risk for affected Cloudreve deployments.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker creates or utilizes an existing third-party OAuth client configured with a minimal scope, such as \u003ccode\u003eopenid\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker convinces a legitimate Cloudreve user to authorize this OAuth application for the specified low-privilege scope.\u003c/li\u003e\n\u003cli\u003eUpon user authorization, Cloudreve issues an authorization code to the OAuth application.\u003c/li\u003e\n\u003cli\u003eThe attacker's OAuth application exchanges this authorization code for an access token by sending a \u003ccode\u003ePOST\u003c/code\u003e request to \u003ccode\u003e/api/v4/session/oauth/token\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eCloudreve's \u003ccode\u003eIssue(...)\u003c/code\u003e function generates the access token, embedding the requested scopes but inadvertently omitting the \u003ccode\u003eClientID\u003c/code\u003e claim in the JWT payload.\u003c/li\u003e\n\u003cli\u003eThe attacker uses this compromised access token as a bearer token (\u003ccode\u003eAuthorization: Bearer \u0026lt;access_token\u0026gt;\u003c/code\u003e) to authenticate subsequent API requests.\u003c/li\u003e\n\u003cli\u003eWhen an API request arrives, Cloudreve's JWT verifier attempts to load scopes into the request context. However, because the access token lacks the \u003ccode\u003eClientID\u003c/code\u003e claim, the scopes are not loaded.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eRequiredScopes(...)\u003c/code\u003e middleware, designed to enforce API access based on scopes, proceeds to check for scopes in the request context. Finding none (due to the missing \u003ccode\u003eClientID\u003c/code\u003e), it incorrectly skips scope enforcement entirely, treating the request as a non-scoped session-based authentication.\u003c/li\u003e\n\u003cli\u003eAs a result, API calls requiring higher scopes (e.g., \u003ccode\u003eFiles.Read/Write\u003c/code\u003e, \u003ccode\u003eShares.Read/Write\u003c/code\u003e, \u003ccode\u003eUserInfo.Write\u003c/code\u003e, \u003ccode\u003eDavAccount.Write\u003c/code\u003e, or even \u003ccode\u003eAdmin.Read/Write\u003c/code\u003e) are processed and executed successfully under the authorizing user's identity, bypassing the intended OAuth scope restrictions.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability does not enable anonymous authentication bypass but allows for a critical OAuth consent and scope boundary bypass. An attacker leveraging this flaw requires a valid OAuth access token for a real user, albeit one initially granted minimal permissions (e.g., \u003ccode\u003eopenid\u003c/code\u003e). Once obtained, this low-privilege token can be illicitly used to perform actions typically restricted to much higher scopes on behalf of the user. For regular users, this could lead to unauthorized access, modification, or deletion of files, shares, workflows, user settings, and WebDAV account/device configurations. If the authorizing user possesses administrative privileges, the same flaw can be exploited to access and manipulate administrator-scoped functionality without the OAuth application ever being explicitly granted \u003ccode\u003eAdmin.Read\u003c/code\u003e or \u003ccode\u003eAdmin.Write\u003c/code\u003e scopes, leading to severe unauthorized administrative control.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch Cloudreve installations immediately to a version that addresses CVE-2026-54560, specifically versions equal to or greater than \u003ccode\u003e4.0.0-20260606015557-ed20843dc3df\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eMonitor application logs and API gateway logs for unusual access patterns by OAuth tokens, particularly calls to sensitive endpoints (\u003ccode\u003eFiles\u003c/code\u003e, \u003ccode\u003eShares\u003c/code\u003e, \u003ccode\u003eWorkflow\u003c/code\u003e, \u003ccode\u003eUser\u003c/code\u003e, \u003ccode\u003eDavAccount\u003c/code\u003e, \u003ccode\u003eAdmin\u003c/code\u003e APIs) made by tokens initially granted minimal scopes.\u003c/li\u003e\n\u003cli\u003eImplement API gateway or proxy-level checks to validate OAuth scopes against API endpoint requirements, ensuring a fail-closed approach for all OAuth token-based requests.\u003c/li\u003e\n\u003cli\u003eRegularly audit all registered OAuth clients within Cloudreve, reviewing their granted permissions and their necessity.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-20T21:19:53Z","date_published":"2026-07-20T21:19:53Z","id":"https://feed.craftedsignal.io/briefs/2026-07-cloudreve-oauth-scope-bypass/","summary":"Cloudreve's OAuth implementation contains a vulnerability, CVE-2026-54560, where OAuth access tokens bypass intended scope enforcement due to a missing `client_id` claim, allowing an attacker with a low-scope token to access sensitive APIs requiring higher privileges, effectively leading to privilege escalation.","title":"Cloudreve OAuth Access Token Scope Bypass Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-07-cloudreve-oauth-scope-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cloudreve","version":"https://jsonfeed.org/version/1.1"}