Cloudreve before 4.17.0 allows an attacker who has an OAuth client authorized with only the Admin.Read scope to trigger the server to send outbound requests to arbitrary URLs through the administrative node test endpoints. This creates a blind server‑side request forgery that can be used for internal service probing, delivery of signed Cloudreve slave requests, or other malicious actions. The flaw is a parameter‑handling weakness (CWE‑863).

The vulnerability affects Cloudreve versions prior to 4.17.0, but specific affected releases are not listed in the CVE data. Administrators using any version of Cloudreve older than 4.17.0 are at risk if they have OAuth clients granted the Admin.Read scope.

The CVSS score of 5.3 indicates moderate severity, and the vulnerability is not listed in CISA KEV. The attack requires an OAuth client that has already been sanctioned by an administrator, but once granted the scope an attacker can craft node definitions that cause the server to resolve arbitrary URLs. Because the flaw does not require local access and is triggered through a documented API, the potential for exploitation exists in contexts where the patch is unavailable or administrators rely on the Admin.Read scope.