The vulnerability lies in Cloudreve's OAuth token issuance, which omits the client_id claim for versions 4.12.0 to 4.16.1; as a result the token verifier fails to load token scopes into the request context and RequiredScopes treats requests as lacking any scope, allowing a low‑scope OAuth token to call APIs that require higher scopes such as file management, sharing, workflow, administrative unauthorized users. This flaw is a classic example of missing scope enforcement (CWE‑863).

The affected product is Cloudreve, version 4.12.0 through 4.16.1 inclusive. The issue is fixed in version 4.16.1 and later releases; earlier versions are vulnerable.

The CVSS score of 7.6 indicates high severity, while the EPSS score of less than 1% suggests low exploitation probability; the vulnerability is not listed in CISA KEV. Exploitation requires possession of a legitimate OAuth token but can, indicating that attackers could elevate privileges by simply calling privileged endpoints with an improperly scoped token.