CVE-2026-101048

Cloudreve before 4.17.0 registers the administrative node test endpoints POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader without requiring the Admin.Write OAuth scope, unlike the node create/update/delete routes. An OAuth client that has been authorized by an administrato...

EUVD-2026-87979

Cloudreve before 4.17.0 registers the administrative node test endpoints POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader without requiring the Admin.Write OAuth scope, unlike the node create/update/delete routes. An OAuth client that has been authorized by an administrato...

CVE-2026-101048

Cloudreve versions before 4.17.0 are vulnerable to a Server-Side Request Forgery (SSRF) flaw. The issue arises because the administrative node test endpoints (POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader) do not require the Admin.Write OAuth scope, unlike other node ma...

CVE-2026-101048 Cloudreve before 4.17.0 SSRF via Admin.Read OAuth scope

Cloudreve before 4.17.0 registers the administrative node test endpoints POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader without requiring the Admin.Write OAuth scope, unlike the node create/update/delete routes. An OAuth client that has been authorized by an administrato...

CVE-2026-101048 Cloudreve before 4.17.0 SSRF via Admin.Read OAuth scope

Cloudreve before 4.17.0 registers the administrative node test endpoints POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader without requiring the Admin.Write OAuth scope, unlike the node create/update/delete routes. An OAuth client that has been authorized by an administrato...

CVE-2026-101048 Cloudreve before 4.17.0 SSRF via Admin.Read OAuth scope

Cloudreve before 4.17.0 registers the administrative node test endpoints POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader without requiring the Admin.Write OAuth scope, unlike the node create/update/delete routes. An OAuth client that has been authorized by an administrato...

CVE-2026-101048: Incorrect Authorization

Cloudreve before 4.17.0 registers the administrative node test endpoints POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader without requiring the Admin.Write OAuth scope, unlike the node create/update/delete routes. An OAuth client that has been authorized by an administrato...

EUVD-2026-87713

Capgo capgo.app is affected by an authorization flaw in the app icon update path. The PUT /app/:id endpoint accepts a user-controlled icon value, normalizes it, and stores it in public.apps.iconurl without verifying that the image path belongs to the target app's own image namespace e.g...

CVE-2026-100618

Capgo (capgo.app) is impacted by an authorization flaw in the app icon update path affecting all versions . The PUT /app/:id endpoint accepts a user-controlled icon value and stores it in public.apps.icon_url without verifying that the path belongs to the target app's specific namespace. This act...

Missing Authorization

Overview @openclaw/diagnostics-prometheus is an OpenClaw diagnostics Prometheus exporter for runtime metrics. Affected versions of this package are vulnerable to Missing Authorization via the authenticated metrics endpoint, which does not enforce the operator.read scope. An authenticated caller...

CVE-2026-100529

OpenClaw versions before 2026.8.1 contain an authorization scope widening vulnerability in file-transfer allow-always approvals that allows attackers to reuse standing grants for unreviewed paths. Attackers can exploit glob metacharacter interpretation and node display name reuse to access siblin...

CVE-2026-100525

The OpenClaw Prometheus diagnostics plugin @openclaw/diagnostics-prometheus before version 2026.9.3 does not enforce the operator.read scope on its authenticated metrics endpoint. In deployments using an identity-bearing Gateway authentication mode such as trusted-proxy, a caller whose effective...

EUVD-2026-87463

OpenClaw npm package 'openclaw' before 2026.7.1 does not enforce the administrator scope requirement on browser control when it is reached through the node.invoke method, although direct browser.request access requires administrator scope. In Gateway deployments that honor caller identity and...

CVE-2026-100588 OpenClaw before 2026.7.1 Authentication Bypass via node.invoke

OpenClaw npm package 'openclaw' before 2026.7.1 does not enforce the administrator scope requirement on browser control when it is reached through the node.invoke method, although direct browser.request access requires administrator scope. In Gateway deployments that honor caller identity and...

CVE-2026-100529 OpenClaw before 2026.8.1 Authorization Scope Widening via File-Transfer

OpenClaw versions before 2026.8.1 contain an authorization scope widening vulnerability in file-transfer allow-always approvals that allows attackers to reuse standing grants for unreviewed paths. Attackers can exploit glob metacharacter interpretation and node display name reuse to access siblin...

EUVD-2026-87521

OpenClaw versions before 2026.8.1 contain an authorization scope widening vulnerability in file-transfer allow-always approvals that allows attackers to reuse standing grants for unreviewed paths. Attackers can exploit glob metacharacter interpretation and node display name reuse to access siblin...

CVE-2026-100529

Versions of OpenClaw before 2026.8.1 are vulnerable to an authorization scope widening flaw within file-transfer allow-always approvals. This issue allows attackers to reuse standing grants for unreviewed paths by exploiting glob metacharacter interpretation and node display name reuse . Conseque...

CVE-2026-100529 OpenClaw before 2026.8.1 Authorization Scope Widening via File-Transfer

OpenClaw versions before 2026.8.1 contain an authorization scope widening vulnerability in file-transfer allow-always approvals that allows attackers to reuse standing grants for unreviewed paths. Attackers can exploit glob metacharacter interpretation and node display name reuse to access siblin...

CVE-2026-100529 OpenClaw before 2026.8.1 Authorization Scope Widening via File-Transfer

OpenClaw versions before 2026.8.1 contain an authorization scope widening vulnerability in file-transfer allow-always approvals that allows attackers to reuse standing grants for unreviewed paths. Attackers can exploit glob metacharacter interpretation and node display name reuse to access siblin...

CVE-2026-100525

The OpenClaw Prometheus diagnostics plugin (@openclaw/diagnostics-prometheus) before version 2026.9.3 fails to enforce the operator.read scope on its authenticated metrics endpoint. In environments utilizing identity-bearing Gateway authentication modes, such as trusted-proxy , an authenticated c...