CVE-2026-77637— Cloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope

Quick assessment

Copy summary Copy citation

Affected

cloudreve cloudreve

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, tool.GET("wopi") and tool.POST("mail") in routers/router.go inherit ScopeAdminRead but omit the RequiredScopes(types.ScopeAdminWrite) middleware applied to neighboring state-changi

CVE-2026-77637 affects cloudreve cloudreve. No confirmed in-the-wild exploitation; assess based on exposure. Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, tool.GET("wopi") and tool.POST("mail") in routers/router.go inherit ScopeAdminRead but omit the Requ CVE-2026-77637 vulnerability details, Shenlong CVE Platform, https://cve.imfht.com/detail/CVE-2026-77637

I. Basic Information for CVE-2026-77637

Affected Products

II. Public POCs for CVE-2026-77637

III. Intelligence Information for CVE-2026-77637

Patches & Fixes for CVE-2026-77637 (1)

• fix(router): require AdminWrite scope for URL test related routes · cloudreve/cloudreve@bce08f8 · GitHub x_refsource_MISC

Other References for CVE-2026-77637 (2)

• Release 4.18.0 · cloudreve/cloudreve · GitHub x_refsource_MISC
• Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope · Advisory · cloudreve/cloudreve · GitHub x_refsource_CONFIRM

• https://www.cve.org/CVERecord?id=CVE-2026-77637

Same Patch Batch · cloudreve · 2026-09-22 · 3 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-77637