Vulnerability · Published Sep 27, 2026 · Assigned by VulnCheck
CVE-2026-101048Cloudreve before 4.17.0 SSRF via Admin.Read OAuth scope
Medium 5.4
In plain English
A medium-severity incorrect authorization in cloudreve from cloudreve. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Cloudreve before 4.17.0 registers the administrative node test endpoints (POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader) without requiring the Admin.Write OAuth scope, unlike the node create/update/delete routes. An OAuth client that has been authorized by an administrator with only the Admin.Read scope can therefore submit attacker-controlled node definitions and cause the Cloudreve server to issue outbound requests to arbitrary URLs, enabling blind server-side request forgery, internal service probing, and delivery of signed Cloudreve slave-style requests to attacker-chosen endpoints.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/cloudreve/Cloudreve | no fix listed | GO-2026-6106 |
| Go | github.com/cloudreve/Cloudreve/v3 | no fix listed | GO-2026-6106 |
| Go | github.com/cloudreve/Cloudreve/v3 | no fix listed | GHSA-v6w6-358x-2433 |
| Go | github.com/cloudreve/Cloudreve/v4 | 4.0.0-20260626022735-332a9d800205 | GO-2026-6106 |
| Go | github.com/cloudreve/Cloudreve/v4 | 4.0.0-20260626022735-332a9d800205 | GHSA-v6w6-358x-2433 |
Affected products (as reported)
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
References
- GitHub Security Advisory (GHSA-v6w6-358x-2433) vendor-advisory
- VulnCheck Advisory: Cloudreve before 4.17.0 SSRF via Admin.Read OAuth scope third-party-advisory