CVE-2026-55502 cloudreve CVE debrief

Who should care

Administrators and users of Cloudreve's file management and sharing system should be aware of this high-severity vulnerability and take immediate action to mitigate potential risks. This includes reviewing and updating access controls, verifying proper implementation of Admin.Write guards, and monitoring for suspicious activity related to OAuth token usage and storage policy modifications. Additionally, security teams should prioritize patching affected systems and consider implementing compensating controls to mitigate potential unauthorized access.

Technical summary

CVE-2026-55502 is a high-severity vulnerability in Cloudreve's file management and sharing system. The POST /api/v4/admin/policy/oauth/signin endpoint requires only Admin.Read privileges, allowing an attacker to persist caller-supplied OneDrive secret and app_id values, potentially modifying storage policy credentials without Admin.Write privileges. This issue is fixed in version 4.17.0. Defenders should review and update access controls for the affected endpoint, verify proper implementation of Admin.Write guards, and monitor for suspicious activity.

Defensive priority

CVE-2026-55502 requires immediate attention due to its high CVSS score of 7.1 and potential impact on Cloudreve's file management and sharing system.

Recommended defensive actions

• Review and update the access controls for the POST /api/v4/admin/policy/oauth/signin endpoint to ensure it requires Admin.Write privileges.
• Verify that the local Admin.Write guard is properly implemented for sibling policy mutation routes.
• Monitor for any suspicious activity related to OAuth token usage and storage policy modifications.
• Consider implementing compensating controls to mitigate potential unauthorized access.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE-2026-55502 issue arises from the POST /api/v4/admin/policy/oauth/signin endpoint requiring only Admin.Read privileges, while persisting caller-supplied OneDrive secret and app_id values, which could allow an OAuth token without Admin.Write to modify storage policy credentials. This highlights the need for defenders to verify affected systems, review current access controls, and ensure proper implementation of Admin.Write guards. Additionally, monitoring for suspicious activity related to OAuth token usage and storage policy modifications is crucial.

Official resources