Go/github.com/cloudreve/Cloudreve/v4 CVE-2026-54560: high 7.6, EPSS 0.46%

Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim

Action: Upgrade github.com/cloudreve/Cloudreve/v4 to 4.0.0-20260606015557-ed20843dc3df or later.

go get github.com/cloudreve/Cloudreve/v4@v4.0.0-20260606015557-ed20843dc3df

Affected

Fixed versions

Sources

• osv: GHSA-vgj4-345g-jcf8
• https://github.com/cloudreve/cloudreve/security/advisories/GHSA-vgj4-345g-jcf8
• https://nvd.nist.gov/vuln/detail/CVE-2026-54560
• https://github.com/cloudreve/cloudreve/commit/ed20843dc3df20a25fcaf6b538647e11c4d68d87
• https://github.com/cloudreve/cloudreve
• https://github.com/cloudreve/cloudreve/releases/tag/4.16.1

CVE-2026-54560 · published 2026-07-20T21:15:20Z · modified 2026-07-22T21:11:20.480991863Z · JSON