# Cloudreve SSRF via incorrect authorization in admin node test endpoints

Source: https://junglewise.ai/threats/cloudreve-ssrf-via-incorrect-authorization-in-admin-node-test-endpoints-65f3e0e9  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-24. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 5.4 · Published 2026-07-24

Cloudreve is a file management system that supports multiple cloud storage backends. A security flaw allows users with limited 'read-only' administrative access to bypass intended restrictions and trigger the server to make unauthorized network requests. This could be used by an attacker to probe internal network services or interact with other private systems that the Cloudreve server can reach.

Technologies: [Cloudreve](https://junglewise.ai/threats/technologies/cloudreve), [github.com/cloudreve/Cloudreve/v3 (Go)](https://junglewise.ai/threats/technologies/github-com-cloudreve-cloudreve-v3), [github.com/cloudreve/Cloudreve/v4 (Go)](https://junglewise.ai/threats/technologies/github-com-cloudreve-cloudreve-v4). Vendors: [Cloudreve](https://junglewise.ai/threats/vendors/cloudreve), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 5.4, published 24 July 2026.

**Which products and versions are affected?** Cloudreve <= 3.0.0-20250225100611-da4e44b77af4; github.com/cloudreve/Cloudreve/v3 (Go) <= 3.0.0-20250225100611-da4e44b77af4; github.com/cloudreve/Cloudreve/v4 (Go) < 4.0.0-20260626022735-332a9d800205.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is This vulnerability attacked?** It is attacked over the network, in a network appliance.

**Am I affected?** Check whether you run Cloudreve, github.com/cloudreve/Cloudreve/v3 (Go) or github.com/cloudreve/Cloudreve/v4 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Cloudreve's administrative API incorrectly enforces authorization scopes on the 'node/test' and 'node/test/downloader' endpoints. While state-changing operations like creating or deleting nodes require the 'Admin.Write' scope, these test endpoints only require 'Admin.Read'. An attacker with a read-scoped OAuth token can provide a malicious node configuration containing an arbitrary URL. The server then performs a POST request to that URL to 'ping' the node, leading to blind SSRF and potential internal network reconnaissance. The issue was addressed by requiring the 'Admin.Write' scope for these test routes.

## Affected products

- Cloudreve Cloudreve/v3 <= 3.0.0-20250225100611-da4e44b77af4
- Cloudreve Cloudreve/v4 < 4.0.0-20260626022735-332a9d800205

## Timeline

- 2026-07-23: disclosed
- 2026-07-24: advisory

## References

- [https://api.github.com/users/DavidCarliez](https://api.github.com/users/DavidCarliez)
- [https://github.com/DavidCarliez](https://github.com/DavidCarliez)
- [https://api.github.com/users/DavidCarliez/gists%7B/gist_id%7D](https://api.github.com/users/DavidCarliez/gists%7B/gist_id%7D)
- [https://api.github.com/users/DavidCarliez/repos](https://api.github.com/users/DavidCarliez/repos)
- [https://avatars.githubusercontent.com/u/271374756?v=4](https://avatars.githubusercontent.com/u/271374756?v=4)
- [https://api.github.com/users/DavidCarliez/events%7B/privacy%7D](https://api.github.com/users/DavidCarliez/events%7B/privacy%7D)

## Related threats

- [Cloudreve access control bypass in share validation](https://junglewise.ai/threats/cve-2026-101056-cloudreve-before-4-16-1-fails-to-revalidate-share-access-when)
- [Cloudreve authorization bypass in admin node test endpoints](https://junglewise.ai/threats/cve-2026-101048-cloudreve-before-4-17-0-registers-the-administrative-node-test)
- [Cloudreve SSRF guard bypass via IPv6 transition wrappers](https://junglewise.ai/threats/cve-2026-79913-cloudreve-ssrf-guard-bypass-via-ipv6-transition-wrappers)
- [Cloudreve privilege scope bypass in admin API endpoints](https://junglewise.ai/threats/cve-2026-77637-cloudreve-privilege-scope-bypass-in-admin-api-endpoints)
- [Cloudreve TOCTOU race in storage-quota check and charge](https://junglewise.ai/threats/cve-2026-77633-cloudreve-toctou-race-in-storage-quota-check-and-charge)