CVE-2026-101048 Details

A server-side request forgery (SSRF) vulnerability has been identified in Cloudreve versions prior to 4.17.0. The issue arises because the application registers administrative node test endpoints without requiring the Admin.Write OAuth scope. This oversight allows an OAuth client authorized by an administrator with only the Admin.Read scope to submit attacker-controlled node definitions. As a result, the Cloudreve server can be manipulated to make outbound requests to arbitrary URLs. This vulnerability could be exploited for blind SSRF, internal service probing, and delivering signed Cloudreve slave-style requests to endpoints chosen by the attacker.

To address this vulnerability, add the Admin.Write scope requirement to the affected node test routes. Additionally, consider implementing SSRF validation or network egress controls for all admin-supplied test URLs.