Cloudreve versions prior to 4.17.0 expose a POST endpoint that requires only an Admin.Read token to persist caller supplied OneDrive client credentials. An attacker with read‑only administrative rights can therefore replace the OneDrive access secret and app_id of any storage policy, potentially gaining persistent access to the underlying cloud storage or denying legitimate users access. This is a classic privilege escalation flaw classified as CWE‑863.

The affected product is Cloudreve (cloudreve:cloudreve). All releases before version 4.17.0 are vulnerable. 4.17.0 and later contain the fix.

The CVSS score of 7.1 indicates a high severity. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog. An attacker only needs a valid Admin.Read token and the path to the admin group, making exploitation straightforward via an HTTP POST to /api/v4/admin/policy/oauth/signin.