CVE-2026-77637

Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, tool.GET"wopi" and tool.POST"mail" in routers/router.go inherit ScopeAdminRead but omit the RequiredScopestypes.ScopeAdminWrite middleware applied to neighboring state-changing admin tool routes. An OAuth application ...