Cloudreve versions prior to 4.18.0 allowed OAuth tokens with the Admin.Read scope to access endpoints normally protected for Admin.Write. The routes tool.GET("wopi") and tool.POST("mail") inherited ScopeAdminRead but omitted the RequiredScopes(types.ScopeAdminWrite) middleware, meaning an attacker could trigger state‑changing operations such as sending arbitrary test emails through the server’s SMTP configuration without exceeding the intended read‑only boundary. This privilege escalation is an instance of improper authorization and is catalogued as CWE-862.

The affected product is Cloudreve, community‑hosted file management and sharing software. All releases before 4.18.0 are vulnerable; the issue was fixed in version 4.18.0 and later versions are not affected.

The CVSS score of 3.8 indicates a low severity vulnerability. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, indicating no publicly known exploitation data at this time. The likely attack vector involves an OAuth application or API key granted the Admin.Read scope, which can be used to send arbitrary emails through the service’s SMTP configuration. While this does not grant full remote code execution, it allows abuse of the mail system and potential phishing or spam campaigns, representing a moderate risk for affected deployments.