CyberRota Analysis
AI-GeneratedCloudreve versions 4.12.0 to 4.16.1 are vulnerable due to the absence of the OAuth client_id claim in issued access tokens, which allows low-scope tokens to access APIs requiring higher permissions, including sensitive operations like file management and user settings. This vulnerability poses a significant risk, as it could lead to unauthorized access and manipulation of user data. Organizations using affected versions should prioritize upgrading to version 4.16.1 to mitigate potential security breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Cloudreve is a self-hosted file management and sharing system. From 4.12.0 until 4.16.1, Cloudreve's OAuth access tokens are issued without the OAuth client_id claim, so the JWT verifier does not load token scopes into request context and RequiredScopes treats the request like non-scoped session authentication, allowing a low-scope OAuth access token to call APIs requiring higher scopes such as file, share, workflow, user setting, WebDAV account, and potentially admin scopes. This issue is fixed in version 4.16.1.