high · 7.1CVE-2026-55502Jul 24, 2026

CVE-2026-55502: Cloudreve Admin.Read OAuth Token Can Overwrite OneDrive Storage Policy Credentials

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

A Cloudreve OAuth token scoped only to read-only admin access can silently overwrite the OneDrive storage policy credentials, including the app secret and app ID, because the sign-in route is missing…

Packagegithub.com/cloudreve/Cloudreve/v4
Ecosystemgo
Affected< 4.0.0-20260613030954-9e9fb43e7288
Fixed in4.17.0
CVE-2026-55502: Cloudreve Admin.Read OAuth Token Can Overwrite OneDrive Storage Policy Credentials

The problem

Cloudreve versions before 4.0.0-20260613030954-9e9fb43e7288 expose POST /api/v4/admin/policy/oauth/signin inside the admin route group that requires only Admin.Read.

Sibling policy mutation routes (create, update, delete, CORS, OAuth callback) each add a local RequiredScopes(types.ScopeAdminWrite) middleware guard. This route omits that guard entirely.

The handler AdminOdOAuthURL calls GetOauthRedirectService.GetOAuth(), which persists the caller-supplied secret and app_id directly into the OneDrive storage policy via an Upsert. An attacker with only a read-only admin OAuth token can corrupt the storage backend configuration, replace the application secret and app ID, and redirect future OAuth setup flows to attacker-controlled credentials.

Proof of concept

A working proof-of-concept for CVE-2026-55502 in github.com/cloudreve/Cloudreve/v4, with the exact payload below.

http
POST /api/v4/admin/policy/oauth/signin HTTP/1.1
Host: <cloudreve-instance>
Authorization: Bearer <admin OAuth token scoped to Admin.Read only>
Content-Type: application/json

{"id":1,"secret":"attacker-secret","app_id":"attacker-app-id"}

The route sits inside the admin group that enforces RequiredScopes(types.ScopeAdminRead), so any valid admin OAuth token reaches it. The missing RequiredScopes(types.ScopeAdminWrite) guard means the scope boundary is never checked for this endpoint.

The handler then writes caller-supplied fields directly to the policy record: policy.SecretKey = service.Secret and policy.BucketName = service.AppID, followed by an Upsert to the database. There is no further authorization check between parsing the JSON body and persisting the values.

The fix, in commit 9e9fb43e7288924cca052e5fdbb70d5365ef1ede, adds middleware.RequiredScopes(types.ScopeAdminWrite) to the oauth.POST("signin", ...) route registration, bringing it in line with every other policy mutation route. CWE-863: Incorrect Authorization.

The fix

Upgrade to Cloudreve 4.17.0 (commit 9e9fb43e7288924cca052e5fdbb70d5365ef1ede). The patch adds middleware.RequiredScopes(types.ScopeAdminWrite) to the oauth.POST("signin", ...) route, so tokens scoped only to Admin.Read are rejected before the handler executes.

While upgrading, audit any other admin routes that perform network or mail actions under only Admin.Read to confirm they do not persist state.

Reporter not attributed.

References: [1][2][3][4]

Related research