Skip to content
Threat Feed
Subscribe

Vendor

Cloudreve

1 brief RSS
high advisory

Cloudreve OAuth Access Token Scope Bypass Vulnerability

Cloudreve's OAuth implementation contains a vulnerability, CVE-2026-54560, where OAuth access tokens bypass intended scope enforcement due to a missing `client_id` claim, allowing an attacker with a low-scope token to access sensitive APIs requiring higher privileges, effectively leading to privilege escalation.

Cloudreve oauth vulnerability privilege-escalation web-application
1t 1c