Executive brief
Cloudreve, a self-hosted file management and sharing system, contains a security flaw in how it handles administrative permissions for OneDrive storage. An attacker with limited 'read-only' administrative access can bypass intended restrictions to modify sensitive storage configuration settings, such as application secrets and IDs. This could allow an attacker to disrupt file storage services, redirect future authentication attempts to their own servers, or gain unauthorized control over the storage backend.
Technical details
An incorrect authorization vulnerability exists in Cloudreve's OneDrive OAuth sign-in route. The endpoint `POST /api/v4/admin/policy/oauth/signin` is protected only by the `Admin.Read` scope, whereas sibling routes that modify storage policies correctly require the `Admin.Write` scope. The `GetOauthRedirectService` handler fails to verify write permissions before persisting attacker-supplied `secret` and `app_id` values into the OneDrive storage policy configuration. An authenticated attacker with a read-only admin OAuth token can exploit this to overwrite persistent storage credentials, potentially hijacking the OAuth flow or causing a denial of service for storage operations. This issue is resolved in version 4.17.0 by adding the `Admin.Write` scope requirement to the affected route.
Affected products
- Cloudreve Cloudreve < 4.17.0
Timeline
- 2026-07-23: advisory: GitHub Security Advisory published
- 2026-07-31: disclosed: NVD publication date