{"id":"GO-2026-6106","revision":"f46fb8d616714249901736b38b639879","records":[{"revision":"f46fb8d616714249901736b38b639879","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6106","aliases":["CVE-2026-101048","GHSA-v6w6-358x-2433"],"title":"Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests in github.com/cloudreve/Cloudreve","description":"Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests in github.com/cloudreve/Cloudreve","state":0,"publishedAt":"2026-08-18T14:32:29+00:00","modifiedAt":"2026-09-28T03:55:28.3330688+00:00","affected":[{"ecosystem":"Go","name":"github.com/cloudreve/Cloudreve","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/cloudreve/Cloudreve/v3","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/cloudreve/Cloudreve/v4","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"4.0.0-20260626022735-332a9d800205"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/cloudreve/cloudreve/security/advisories/GHSA-v6w6-358x-2433","https://github.com/cloudreve/cloudreve/commit/332a9d800205082a2469e555fd66a63f18d9d5dc","https://github.com/cloudreve/cloudreve/releases/tag/4.17.0"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6106","license":"OSV · upstream source license applies","key":"osv:GO-2026-6106","identifiers":["GO-2026-6106","CVE-2026-101048","GHSA-v6w6-358x-2433"]},"retained":false,"historicalAffected":[]}],"coverage":[]}