SEPTEMBER 9, 2026
Live Feed
Back to database
Case File

CVE-2026-54560

HIGH · CVSS 7.6 EPSS 0.25% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-15 · Last synced 2026-08-14

CyberRota Analysis

AI-Generated

Cloudreve versions 4.12.0 to 4.16.1 are vulnerable due to the absence of the OAuth client_id claim in issued access tokens, which allows low-scope tokens to access APIs requiring higher permissions, including sensitive operations like file management and user settings. This vulnerability poses a significant risk, as it could lead to unauthorized access and manipulation of user data. Organizations using affected versions should prioritize upgrading to version 4.16.1 to mitigate potential security breaches.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-54560
Severity
HIGH
CVSS
7.6
EPSS
0.25%

Original NVD Description

Cloudreve is a self-hosted file management and sharing system. From 4.12.0 until 4.16.1, Cloudreve's OAuth access tokens are issued without the OAuth client_id claim, so the JWT verifier does not load token scopes into request context and RequiredScopes treats the request like non-scoped session authentication, allowing a low-scope OAuth access token to call APIs requiring higher scopes such as file, share, workflow, user setting, WebDAV account, and potentially admin scopes. This issue is fixed in version 4.16.1.