PT-2026-60180 · Cloudreve · Cloudreve

CVE-2026-54560 · Published 2026-07-15 · Updated 2026-07-30

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Cloudreve versions 4.12.0 through 4.16.0

Description OAuth access tokens are issued without the client id claim. Consequently, the JWT (JSON Web Token) verifier fails to load token scopes into the request context. This causes the RequiredScopes function to treat requests as non-scoped session authentication, enabling a token with low-level permissions to access APIs requiring higher scopes, including those for files, shares, workflows, user settings, WebDAV accounts, and potentially administrative functions.

Recommendations Update to version 4.16.1.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-54560

GHSA-VGJ4-345G-JCF8

GO-2026-6022

OPENSUSE-SU-2026:21483-1

Affected Products

Cloudreve

References · 1744

• 🔥 https://github.com/cloudreve/cloudreve/security/advisories/GHSA-vgj4-345g-jcf8 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54560.json · Exploit
• https://osv.dev/vulnerability/GO-2026-6022 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-54560 · Security Note
• https://osv.dev/vulnerability/CVE-2026-54560 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:21483-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vgj4-345g-jcf8 · Vendor Advisory
• https://github.com/cloudreve/cloudreve · Note
• https://github.com/cloudreve/cloudreve/releases/tag/4.16.1 · Note
• https://github.com/cloudreve/cloudreve/commit/ed20843dc3df20a25fcaf6b538647e11c4d68d87 · Note
• https://suse.com/security/cve/CVE-2025-67499 · Note
• https://suse.com/security/cve/CVE-2026-25726 · Note
• https://suse.com/security/cve/CVE-2026-24005 · Note
• https://suse.com/security/cve/CVE-2025-13821 · Note
• https://suse.com/security/cve/CVE-2026-23845 · Note