File Management System Vulnerability in Cloudreve
CVE-2026-77637

3.8LOW

Key Information:

Vendor

Cloudreve

Status
Cloudreve
Vendor
CVE Published:
22 September 2026

What is CVE-2026-77637?

Cloudreve is a self-hosted file management and sharing system that faced an access control issue prior to version 4.18.0. The tool.GET("wopi") and tool.POST("mail") methods in its routing module lacked the appropriate middleware to enforce write permissions. Consequently, an OAuth application or API key with only read permissions could exploit this oversight to access WOPI service endpoints and send arbitrary emails using the server's SMTP configuration. This vulnerability allowed for actions beyond the intended scope of read-only access. The issue was addressed and fixed in version 4.18.0, ensuring that appropriate access controls are in place to safeguard user data and functionalities.

Affected Version(s)

cloudreve < 4.18.0

References

https://github.com/cloudreve/cloudreve/security/advisorie...
x_refsource_CONFIRM
https://github.com/cloudreve/cloudreve/commit/bce08f88e9d...
x_refsource_MISC
https://github.com/cloudreve/cloudreve/releases/tag/4.18.0
x_refsource_MISC

CVSS V3.1

Score:
3.8
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.