https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 13:00:31 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-338040 EUVD-2026-338040 https://cve.radiocsirt.org/vuln/euvd-2026-338040 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54560 <p>Cloudreve is a self-hosted file management and sharing system. From 4.12.0 until 4.16.1, Cloudreve&#39;s OAuth access tokens are issued without the OAuth client_id claim, so the JWT verifier does not load token scopes into request context and RequiredScopes treats the request like non-scoped session authentication, allowing a low-scope OAuth access token to call APIs requiring higher scopes such as file, share, workflow, user setting, WebDAV account, and potentially admin scopes. This issue is fixed in version 4.16.1.</p> <p>Cloudreve is a self-hosted file management and sharing system. From 4.12.0 until 4.16.1, Cloudreve&#39;s OAuth access tokens are issued without the OAuth client_id claim, so the JWT verifier does not load token scopes into request context and RequiredScopes treats the request like non-scoped session authentication, allowing a low-scope OAuth access token to call APIs requiring higher scopes such as file, share, workflow, user setting, WebDAV account, and potentially admin scopes. This issue is fixed in version 4.16.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-54560 https://cve.radiocsirt.org/vuln/ghsa-vgj4-345g-jcf8 <p><strong>Affected:</strong> Go: github.com/cloudreve/Cloudreve/v4</p> <p>## Summary</p> <p>Cloudreve&#39;s OAuth access tokens can bypass OAuth scope enforcement.</p> <p>This does not appear to be the intended design. The documentation describes OAuth client permissions/scopes, the API has an insufficient-scope error code, and the code comments say `RequiredScopes(...)` should verify scopes when a token has scopes, while skipping checks only for non-scoped session-based authentication.</p> <p>However, OAuth access tokens are issued without the OAuth `client_id` claim. Later, the JWT verifier only loads scopes into the request context when `claims.ClientID != &#34;&#34;`. Because the OAuth access token has no `client_id`, its scopes are not loaded, and `RequiredScopes(...)` treats the request like a non-scoped first-party/session token and skips scope checks.</p> <p>As a result, a low-scope OAuth access token, for example one granted only `openid`, can call APIs requiring higher scopes such as file, share, workflow, user setting, WebDAV account, and potentially admin scopes when the authorizing user is an administrator.</p> <p>## Why this seems unintended</p> <p>Cloudreve appears to have an explicit OAuth scope model:</p> <p>1. The official docs describe OAuth client permissions/scopes and require the authorization request to include requested scopes. 2. The API error code list includes an OAuth insufficient-scope error. 3. `RequiredScopes(...)` is used across sensitive API groups such as files, shares, workflows, user settings, WebDAV devices, and admin APIs. 4.…</p> <p><strong>Affected:</strong> Go: github.com/cloudreve/Cloudreve/v4</p> <p>## Summary</p> <p>Cloudreve&#39;s OAuth access tokens can bypass OAuth scope enforcement.</p> <p>This does not appear to be the intended design. The documentation describes OAuth client permissions/scopes, the API has an insufficient-scope error code, and the code comments say `RequiredScopes(...)` should verify scopes when a token has scopes, while skipping checks only for non-scoped session-based authentication.</p> <p>However, OAuth access tokens are issued without the OAuth `client_id` claim. Later, the JWT verifier only loads scopes into the request context when `claims.ClientID != &#34;&#34;`. Because the OAuth access token has no `client_id`, its scopes are not loaded, and `RequiredScopes(...)` treats the request like a non-scoped first-party/session token and skips scope checks.</p> <p>As a result, a low-scope OAuth access token, for example one granted only `openid`, can call APIs requiring higher scopes such as file, share, workflow, user setting, WebDAV account, and potentially admin scopes when the authorizing user is an administrator.</p> <p>## Why this seems unintended</p> <p>Cloudreve appears to have an explicit OAuth scope model:</p> <p>1. The official docs describe OAuth client permissions/scopes and require the authorization request to include requested scopes. 2. The API error code list includes an OAuth insufficient-scope error. 3. `RequiredScopes(...)` is used across sensitive API groups such as files, shares, workflows, user settings, WebDAV devices, and admin APIs. 4.…</p> https://cve.radiocsirt.org/vuln/ghsa-vgj4-345g-jcf8