# CVE-2026-55502: Cloudreve incorrect authorization in OneDrive storage policy configuration

Source: https://junglewise.ai/threats/cve-2026-55502-cloudreve-incorrect-authorization-in-onedrive-storage-policy  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-31. Updated: 2026-07-31  
License: CC BY 4.0 with a link back

CVE-2026-55502 · Severity: high · CVSS 7.1 · Published 2026-07-31

Cloudreve, a self-hosted file management and sharing system, contains a security flaw in how it handles administrative permissions for OneDrive storage. An attacker with limited 'read-only' administrative access can bypass intended restrictions to modify sensitive storage configuration settings, such as application secrets and IDs. This could allow an attacker to disrupt file storage services, redirect future authentication attempts to their own servers, or gain unauthorized control over the storage backend.

Technologies: [Cloudreve](https://junglewise.ai/threats/technologies/cloudreve), [github.com/cloudreve/Cloudreve (Go)](https://junglewise.ai/threats/technologies/github-com-cloudreve-cloudreve), [github.com/cloudreve/Cloudreve/v3 (Go)](https://junglewise.ai/threats/technologies/github-com-cloudreve-cloudreve-v3), [github.com/cloudreve/Cloudreve/v4 (Go)](https://junglewise.ai/threats/technologies/github-com-cloudreve-cloudreve-v4). Vendors: [Cloudreve](https://junglewise.ai/threats/vendors/cloudreve), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-55502 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55502 being exploited in the wild.

**How severe is CVE-2026-55502?** High severity, with a CVSS score of 7.1, published 31 July 2026.

**Which products and versions are affected?** Cloudreve < 4.17.0; github.com/cloudreve/Cloudreve (Go) SEMVER:introduced=0; github.com/cloudreve/Cloudreve/v3 (Go) <= 3.0.0-20250225100611-da4e44b77af4, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=3.0.0-20250225100611-da4e44b77af4; github.com/cloudreve/Cloudreve/v4 (Go) < 4.0.0-20260613030954-9e9fb43e7288, SEMVER:introduced=0, SEMVER:introduced=0,fixed=4.17.0.

**Is there a fix for CVE-2026-55502?** Yes. github.com/cloudreve/Cloudreve/v4 (Go): upgrade to 4.17.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55502 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-55502?** Check whether you run Cloudreve, github.com/cloudreve/Cloudreve (Go), github.com/cloudreve/Cloudreve/v3 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/cloudreve/Cloudreve/v4 (Go): upgrade to 4.17.0 or later

  ```sh
  go get github.com/cloudreve/Cloudreve/v4@v4.17.0
  ```


## Technical details

An incorrect authorization vulnerability exists in Cloudreve's OneDrive OAuth sign-in route. The endpoint `POST /api/v4/admin/policy/oauth/signin` is protected only by the `Admin.Read` scope, whereas sibling routes that modify storage policies correctly require the `Admin.Write` scope. The `GetOauthRedirectService` handler fails to verify write permissions before persisting attacker-supplied `secret` and `app_id` values into the OneDrive storage policy configuration. An authenticated attacker with a read-only admin OAuth token can exploit this to overwrite persistent storage credentials, potentially hijacking the OAuth flow or causing a denial of service for storage operations. This issue is resolved in version 4.17.0 by adding the `Admin.Write` scope requirement to the affected route.

## Affected products

- Cloudreve Cloudreve < 4.17.0

## Identifiers

- CVE-2026-55502
- GHSA-hq88-5x99-x3gf
- GO-2026-6101

## Timeline

- 2026-07-23: advisory: GitHub Security Advisory published
- 2026-07-31: disclosed: NVD publication date

## References

- [https://github.com/cloudreve/cloudreve/security/advisories/GHSA-hq88-5x99-x3gf](https://github.com/cloudreve/cloudreve/security/advisories/GHSA-hq88-5x99-x3gf)

## Related threats

- [Cloudreve access control bypass in share validation](https://junglewise.ai/threats/cve-2026-101056-cloudreve-before-4-16-1-fails-to-revalidate-share-access-when)
- [Cloudreve authorization bypass in admin node test endpoints](https://junglewise.ai/threats/cve-2026-101048-cloudreve-before-4-17-0-registers-the-administrative-node-test)
- [Cloudreve SSRF guard bypass via IPv6 transition wrappers](https://junglewise.ai/threats/cve-2026-79913-cloudreve-ssrf-guard-bypass-via-ipv6-transition-wrappers)
- [Cloudreve privilege scope bypass in admin API endpoints](https://junglewise.ai/threats/cve-2026-77637-cloudreve-privilege-scope-bypass-in-admin-api-endpoints)
- [Cloudreve TOCTOU race in storage-quota check and charge](https://junglewise.ai/threats/cve-2026-77633-cloudreve-toctou-race-in-storage-quota-check-and-charge)