CVE-2026-77637

Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, tool.GET("wopi") and tool.POST("mail") in routers/router.go inherit ScopeAdminRead but omit the RequiredScopes(types.ScopeAdminWrite) middleware applied to neighboring state-changing admin tool routes. An OAuth application or API key limited to Admin.Read can therefore probe configured WOPI service endpoints and send arbitrary test email through the server SMTP configuration, exceeding the token's intended read-only authorization boundary. This issue is fixed in version 4.18.0.

• CWE-862

• https://github.com/cloudreve/cloudreve/commit/bce08f88e9d8f881e78fd18e7a6598b31922c492
• https://github.com/cloudreve/cloudreve/releases/tag/4.18.0
• https://github.com/cloudreve/cloudreve/security/advisories/GHSA-w89x-c962-c44g

Published

Sep 22, 2026

Last Modified

Sep 22, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-77620Vector is a high-performance observability data pipeline. Fr…8.7
• CVE-2026-77621Vector is a high-performance observability data pipeline. Fr…9.3
• CVE-2026-7763A heap-based buffer overflow vulnerability in the morse.ko H…9.8
• CVE-2026-77633Cloudreve is a self-hosted file management and sharing syste…7.1
• CVE-2026-77634CakePHP is a rapid development framework for PHP. Prior to v…8.2
• CVE-2026-77635CakePHP is a rapid development framework for PHP. Prior to v…9.2
• CVE-2026-77638Tor before 0.4.9.11 is prone to a race condition where in ju…9
• CVE-2026-77639Tor before 0.4.9.9 was prone to a compression bomb bypass wh…5.3
• CVE-2026-7764An out-of-bounds read vulnerability in the morse.ko HaLow Wi…6.8
• CVE-2026-77640tor before 0.4.9.9 was prone to an infinite loop when decomp…5.3
• CVE-2026-77641tor before 0.4.9.9 was prone to a NULL write after free when…8.2
• CVE-2026-77642tor before 0.4.9.9 was prone to an out-of-bounds write when …9.3