CVE-2026-55502 Cloudreve: OAuth Admin.Read scope can update OneDrive storage policy credentials

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/policy/oauth/signin requires only Admin.Read even though GetOauthRedirectService persists caller-supplied OneDrive secret and appid values, allowing an OAuth token without Admin.Write to modify...

CVE-2026-55502 Cloudreve: OAuth Admin.Read scope can update OneDrive storage policy credentials

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/policy/oauth/signin requires only Admin.Read even though GetOauthRedirectService persists caller-supplied OneDrive secret and appid values, allowing an OAuth token without Admin.Write to modify...

EUVD-2026-51394

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/policy/oauth/signin requires only Admin.Read even though GetOauthRedirectService persists caller-supplied OneDrive secret and appid values, allowing an OAuth token without Admin.Write to modify...

CVE-2026-55502

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/policy/oauth/signin requires only Admin.Read even though GetOauthRedirectService persists caller-supplied OneDrive secret and appid values, allowing an OAuth token without Admin.Write to modify...

CVE-2026-14027

An use after free flaw was found in the SignIn component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=361375787...

Cloudreve OAuth Admin.Read scope can update OneDrive storage policy credentials

Summary Cloudreve 4.16.1 has an OAuth scope authorization bypass in the admin storage policy routes. An OAuth bearer token scoped to Admin.Read but not Admin.Write can call POST /api/v4/admin/policy/oauth/signin and update OneDrive storage policy credentials. The route is inside the admin group...

GHSA-HQ88-5X99-X3GF Cloudreve OAuth Admin.Read scope can update OneDrive storage policy credentials

Summary Cloudreve 4.16.1 has an OAuth scope authorization bypass in the admin storage policy routes. An OAuth bearer token scoped to Admin.Read but not Admin.Write can call POST /api/v4/admin/policy/oauth/signin and update OneDrive storage policy credentials. The route is inside the admin group...

Open WebUI: Account enumeration via observable login timing discrepancy

Summary The /api/v1/auths/signin endpoint leaked whether an email address belonged to a registered account through a response-time side channel. Password verification ran bcrypt only when the email was found in the database; for a non-existent email the request returned early without hashing. The...

EUVD-2026-42617

Open WebUI: Account enumeration via observable login timing discrepancy...

PT-2026-64435

Name of the Vulnerable Software and Affected Versions Cloudreve versions prior to 4.17.0 Description An OAuth scope authorization bypass exists in the admin storage policy routes. A user with an OAuth bearer token scoped only to Admin.Read can access the 'POST /api/v4/admin/policy/oauth/signin'...

CVE-2024-58362

SurrealDB before 1.5.5 and 2.0.0-beta before 2.0.0-beta.3 accepts an arbitrary object in the signin and signup operations of the RPC API without recursively validating it for non-computed values. When a record access method defines a SIGNIN or SIGNUP query and the RPC API is exposed to untrusted...

CVE-2024-58362

SurrealDB before 1.5.5 and 2.0.0-beta before 2.0.0-beta.3 accepts an arbitrary object in the signin and signup operations of the RPC API without recursively validating it for non-computed values. When a record access method defines a SIGNIN or SIGNUP query and the RPC API is exposed to untrusted...

CVE-2024-58362 SurrealDB before 1.5.5 Query Injection via RPC API

SurrealDB before 1.5.5 and 2.0.0-beta before 2.0.0-beta.3 accepts an arbitrary object in the signin and signup operations of the RPC API without recursively validating it for non-computed values. When a record access method defines a SIGNIN or SIGNUP query and the RPC API is exposed to untrusted...

EUVD-2024-55678

SurrealDB before 1.5.5 and 2.0.0-beta before 2.0.0-beta.3 accepts an arbitrary object in the signin and signup operations of the RPC API without recursively validating it for non-computed values. When a record access method defines a SIGNIN or SIGNUP query and the RPC API is exposed to untrusted...

CVE-2024-58362

SurrealDB vulnerability CVE-2024-58362 affects prior releases (before 1.5.5 and 2.0.0-beta before 2.0.0-beta.3) where an arbitrary object can be accepted in signin/signup via the RPC API without recursive validation for non-computed values. An unauthenticated attacker could encode a binary object...

CVE-2024-58362 SurrealDB before 1.5.5 Query Injection via RPC API

SurrealDB before 1.5.5 and 2.0.0-beta before 2.0.0-beta.3 accepts an arbitrary object in the signin and signup operations of the RPC API without recursively validating it for non-computed values. When a record access method defines a SIGNIN or SIGNUP query and the RPC API is exposed to untrusted...

CVE-2024-58362 SurrealDB before 1.5.5 Query Injection via RPC API

SurrealDB before 1.5.5 and 2.0.0-beta before 2.0.0-beta.3 accepts an arbitrary object in the signin and signup operations of the RPC API without recursively validating it for non-computed values. When a record access method defines a SIGNIN or SIGNUP query and the RPC API is exposed to untrusted...

CVE-2026-59218

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, the /api/v1/auths/signin endpoint looked users up by email and only ran bcrypt password verification when a credential existed, making registered-account attempts measurably slower than...

CVE-2026-59218

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, the /api/v1/auths/signin endpoint looked users up by email and only ran bcrypt password verification when a credential existed, making registered-account attempts measurably slower than...

CVE-2026-59218 Open WebUI: Account enumeration via observable login timing discrepancy

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, the /api/v1/auths/signin endpoint looked users up by email and only ran bcrypt password verification when a credential existed, making registered-account attempts measurably slower than...