Cloudreve, a self-hosted file management system, allows an attacker who has a view session to forge the suffix of a WOPI access token. Because the token's secret is ignored, the application does not enforce the intended viewer action, letting the attacker target write routes and overwrite the underlying file. The flaw represents a missing authorization check (CWE‑863) that could compromise file integrity.

All installations of Cloudreve prior to version 4.17.0 are affected. The vendor product is Cloudreve, and any deployment using an earlier release should be considered vulnerable until the update is applied.

The CVSS score of 6.3 indicates a moderate severity vulnerability. The EPSS score is less than 1% and the issue is not listed in CISA KEV, suggesting no known active exploitation. The vulnerability can be leveraged via a WOPI viewer integration; an attacker obtains or hijacks a view session and then crafts a malicious token to trigger write operations. Successful exploitation would grant the attacker the ability to modify files that should be read‑only, potentially leading to data loss or tampering.