Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-55502

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/policy/oauth/signin requires only Admin.Read even though GetOauthRedirectService persists caller-supplied OneDrive secret and app_id values, allowing an OAuth token without Admin.Write to modify storage policy credentials. The route is inside the admin group that requires Admin.Read, but it does not add the local Admin.Write guard used by sibling policy mutation routes. Its handler persists attacke
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:656541d39659fe3e81ef1b805c5ae2d4166858bc956b02560535a8bd0f704c7f
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"product":"cloudreve","vendor":"cloudreve","versions":[{"status":"affected","version":"< 4.17.0"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:c6e138c2743eda5be1262801fb3ab09cb54c9b1a0dacf09d8c7f7ff63196f661 · sha256:b9eede87207a61f1… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:c6e138c2743eda5be1262801fb3ab09cb54c9b1a0dacf09d8c7f7ff63196f661 · sha256:b9eede87207a61f1… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion
{"cweId":"CWE-863","description":"CWE-863: Incorrect Authorization","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:c6e138c2743eda5be1262801fb3ab09cb54c9b1a0dacf09d8c7f7ff63196f661 · sha256:b9eede87207a61f1… · /containers/cna/problemTypes/0/descriptions/0

Source references

2 source assertions
{"name":"https://github.com/cloudreve/cloudreve/security/advisories/GHSA-hq88-5x99-x3gf","tags":["x_refsource_CONFIRM"],"url":"https://github.com/cloudreve/cloudreve/security/advisories/GHSA-hq88-5x99-x3gf"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:c6e138c2743eda5be1262801fb3ab09cb54c9b1a0dacf09d8c7f7ff63196f661 · sha256:b9eede87207a61f1… · /containers/cna/references/0
{"tags":["exploit"],"url":"https://github.com/cloudreve/cloudreve/security/advisories/GHSA-hq88-5x99-x3gf"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:c6e138c2743eda5be1262801fb3ab09cb54c9b1a0dacf09d8c7f7ff63196f661 · sha256:b9eede87207a61f1… · /containers/adp/0/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer