---
id: CVE-2026-77637
title: Cloudreve is a self-hosted file management and sharing system
summary: >-
  Cloudreve is a self-hosted file management and sharing system. Prior to
  4.18.0, tool.GET("wopi") and tool.POST("mail") in routers/router.go inherit
  ScopeAdminRead but omit the RequiredScopes(types.ScopeAdminWrite) middleware
  applied to n…
severity: low
cvss: 3.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-862
vendor: cloudreve
product: cloudreve
affected:
  - cloudreve < 4.18.0
published: '2026-09-22'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T18:17:19.553'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-77637'
references:
  - url: >-
      https://github.com/cloudreve/cloudreve/commit/bce08f88e9d8f881e78fd18e7a6598b31922c492
    label: security-advisories@github.com
  - url: 'https://github.com/cloudreve/cloudreve/releases/tag/4.18.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/cloudreve/cloudreve/security/advisories/GHSA-w89x-c962-c44g
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-77637'
  - url: 'https://github.com/advisories/GHSA-w89x-c962-c44g'
  - url: 'https://github.com/cloudreve/cloudreve'
tags:
  - nvd
  - cve.org
  - ghsa
  - go
  - osv
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-22T17:33:08.150715Z'
ingestedAt: '2026-09-22T16:06:00.490Z'
aliases:
  - GHSA-w89x-c962-c44g
ecosystem: go
patched:
  - github.com/cloudreve/Cloudreve/v4 4.0.0-20260715070110-bce08f88e9d8
epss: 0.00326
epssPercentile: 0.22901
---

## Overview

Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, tool.GET("wopi") and tool.POST("mail") in routers/router.go inherit ScopeAdminRead but omit the RequiredScopes(types.ScopeAdminWrite) middleware applied to neighboring state-changing admin tool routes. An OAuth application or API key limited to Admin.Read can therefore probe configured WOPI service endpoints and send arbitrary test email through the server SMTP configuration, exceeding the token's intended read-only authorization boundary. This issue is fixed in version 4.18.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-77637)

Affected packages:

- `github.com/cloudreve/Cloudreve/v4 < 4.0.0-20260715070110-bce08f88e9d8`

Patched in:

- `github.com/cloudreve/Cloudreve/v4 4.0.0-20260715070110-bce08f88e9d8`

Source: https://github.com/advisories/GHSA-w89x-c962-c44g