Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/policy/oauth/signin requires only Admin.Read even though GetO…

CVE-2026-55502 affects Cloudreve, a self-hosted file management and sharing system, in versions prior to 4.17.0. The vulnerability exists in the POST /api/v4/admin/policy/oauth/signin endpoint, which incorrectly requires only Admin.Read permission instead of Admin.Write. The GetOauthRedirectService handler persists caller-supplied OneDrive secret and app_id values into storage policies without proper authorization checks. This allows an attacker with an OAuth token bearing only Admin.Read privileges to modify OneDrive storage policy credentials, which should require Admin.Write. The flaw stems from the route being inside the admin group with Admin.Read enforcement but lacking the Admin.Write guard applied to sibling policy mutation routes. An attacker could supply malicious secret and app_id values to hijack or manipulate OneDrive storage policy configurations. The issue has been remediated in Cloudreve version 4.17.0.