CVE-2026-77637: CVE-2026-77637: Privilege Scope Bypass in Cloudreve Administrative Tools

#security #cve #cybersecurity

CVE-2026-77637: Privilege Scope Bypass in Cloudreve Administrative Tools

Vulnerability ID: CVE-2026-77637
CVSS Score: 3.8
Published: 2026-09-22

CVE-2026-77637 is a privilege scope bypass vulnerability in Cloudreve. It allows authenticated clients possessing read-only administrative credentials to access sensitive administrative tool endpoints that should require write-level permissions.

TL;DR

Missing authorization checks in Cloudreve allow read-only administrators to trigger SMTP test emails and retrieve WOPI discovery settings.

Technical Details

CWE ID: CWE-862 (Missing Authorization)
Attack Vector: Network (AV:N)
CVSS v3.1 Score: 3.8 (Low)
Exploit Status: None (No public exploit available)
CISA KEV Status: Not Listed
Impact: Low (Bypasses administrative write protections)

Affected Systems

Cloudreve
Cloudreve: < 4.18.0 (Fixed in: 4.18.0)

Code Analysis

Commit: bce08f8

Secure the wopi and mail endpoints by introducing RequiredScopes(types.ScopeAdminWrite)

Mitigation Strategies

Upgrade Cloudreve to version 4.18.0 or later.
Audit administrative API keys and enforce the principle of least privilege.
Restrict outbound SMTP server connections using firewall egress filters.

Remediation Steps:

Download the latest Cloudreve release (4.18.0 or later).
Replace the existing binary with the updated version.
Restart the Cloudreve system service.
Verify the scope permissions of all active OAuth tokens.

References

Read the full report for CVE-2026-77637 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community