{"id":"EUVD-2026-87979","enisaUuid":"cb80c6d2-2208-3e04-bcc9-481e41a51928","description":"Cloudreve before 4.17.0 registers the administrative node test endpoints (POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader) without requiring the Admin.Write OAuth scope, unlike the node create/update/delete routes. An OAuth client that has been authorized by an administrator with only the Admin.Read scope can therefore submit attacker-controlled node definitions and cause the Cloudreve server to issue outbound requests to arbitrary URLs, enabling blind server-side request forgery, internal service probing, and delivery of signed Cloudreve slave-style requests to attacker-chosen endpoints.","datePublished":"Sep 27, 2026, 5:02:36 PM","dateUpdated":"Oct 8, 2026, 3:22:07 PM","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/cloudreve/cloudreve/security/advisories/GHSA-v6w6-358x-2433\nhttps://www.vulncheck.com/advisories/cloudreve-before-4.17.0-ssrf-via-admin-read-oauth-scope\n","aliases":"CVE-2026-101048\nGHSA-pg9h-w4pm-q3vr\n","assigner":"VulnCheck","epss":0.24,"enisaIdProduct":[{"id":"6e08fb76-854f-3d38-984a-a2a3f53798dc","product":{"name":"Cloudreve","vendor":{"name":"Cloudreve"}},"product_version":"0 \u003c4.17.0"}],"enisaIdVendor":[{"id":"08d09e42-7cd3-3b72-9865-b085aad11de5","vendor":{"name":"Cloudreve"}}],"enisaIdVulnerability":[{"id":"2703c42f-0853-3848-9d54-9cfe520a2a43","vulnerability":{"id":"CVE-2026-101048","description":"Cloudreve before 4.17.0 registers the administrative node test endpoints (POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader) without requiring the Admin.Write OAuth scope, unlike the node create/update/delete routes. An OAuth client that has been authorized by an administrator with only the Admin.Read scope can therefore submit attacker-controlled node definitions and cause the Cloudreve server to issue outbound requests to arbitrary URLs, enabling blind server-side request forgery, internal service probing, and delivery of signed Cloudreve slave-style requests to attacker-chosen endpoints.","datePublished":"Sep 27, 2026, 5:02:36 PM","dateUpdated":"Oct 8, 2026, 3:22:07 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/cloudreve/cloudreve/security/advisories/GHSA-v6w6-358x-2433\nhttps://www.vulncheck.com/advisories/cloudreve-before-4.17.0-ssrf-via-admin-read-oauth-scope\n","enisa_id":"EUVD-2026-87979\n","assigner":"VulnCheck","epss":0.24,"dataProcessed":"Oct 29, 2026, 7:14:36 AM","vulnerabilityProduct":[{"id":"d4c1133e-257f-3a6f-a428-43e2553ca655","product":{"name":"Cloudreve","vendor":{"name":"Cloudreve"}},"product_version":"0 \u003c4.17.0"}],"vulnerabilityVendor":[{"id":"b62cc367-cddb-3449-8508-a884147b3e5d","vendor":{"name":"Cloudreve"}}]}},{"id":"b3bf02b5-5823-3046-81e9-7c182a236933","vulnerability":{"id":"GHSA-pg9h-w4pm-q3vr","description":"Cloudreve before 4.17.0 registers the administrative node test endpoints (POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader) without requiring the Admin.Write OAuth scope, unlike the node create/update/delete routes. An OAuth client that has been authorized by an administrator with only the Admin.Read scope can therefore submit attacker-controlled node definitions and cause the Cloudreve server to issue outbound requests to arbitrary URLs, enabling blind server-side request forgery, internal service probing, and delivery of signed Cloudreve slave-style requests to attacker-chosen endpoints.","datePublished":"Sep 27, 2026, 6:30:23 PM","dateUpdated":"Sep 27, 2026, 6:30:23 PM","baseScore":0.0,"references":"https://github.com/cloudreve/cloudreve/security/advisories/GHSA-v6w6-358x-2433\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-101048\nhttps://www.vulncheck.com/advisories/cloudreve-before-4.17.0-ssrf-via-admin-read-oauth-scope\n","enisa_id":"EUVD-2026-87979\n","aliases":"GHSA-pg9h-w4pm-q3vr\nCVE-2026-101048\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}