Technical impact
Rclone from 1.52.0 through 1.75.1 contains a Cross‑Site Request Forgery flaw in the pCloud backend’s localhost OAuth callback. The state check that normally protects the authorization flow is disabled, and the hostname parameter is blindly trusted. An attacker can load a malicious web page that sends a stateless request to the local port 53682 during the OAuth process. This lets the attacker plant their own OAuth tokens and API host configuration into rclone’s local cache, causing future file transfers to be directed to the attacker’s storage system. The impact of this flaw is that an attacker can cause a user’s rclone client to store and use compromised credentials, resulting in unauthorized reading, writing, or deletion of data stored in the target account. Since the flaw operates entirely through local browser interaction, it does not require network access to the attacker’s machine, only that the victim visit a malicious page while rclone is running. The vulnerability is classified as CWE‑346, representing a broken access control where the state parameter is not validated.
Affected Systems
The affected product is rclone: rclone. Versions 1.52.0 up to and including 1.75.1 are vulnerable. rclone 1.75.2 and later contain a fix that restores proper state verification and hostname validation in the pCloud OAuth callback.
Risk and Exploitability
The CVSS score of 7.6 indicates a medium‑to‑high severity issue. Exploitation requires the victim to visit a malicious web page while rclone is running, making it a local‑browser‑based CSRF attack. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, so there is no known public exploitation data. However, the lack of state validation creates a high potential for successful exploitation if an attacker can surface a malicious page to the target.
