{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"github.com/cloudreve/Cloudreve","cve_ids":["CVE-2026-54560"],"ecosystem":"Go","epss":0.00463,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-vgj4-345g-jcf8","id":"tcs_01M5KGRBNM55RWFDHR67Y7E3AS","modified_at":"2026-07-22T21:00:25.559181010Z","published_at":"2026-07-22T20:36:35Z","references":["https://osv.dev/vulnerability/GO-2026-6022","https://github.com/cloudreve/cloudreve/security/advisories/GHSA-vgj4-345g-jcf8","https://nvd.nist.gov/vuln/detail/CVE-2026-54560","https://github.com/cloudreve/cloudreve/commit/ed20843dc3df20a25fcaf6b538647e11c4d68d87","https://github.com/cloudreve/cloudreve/releases/tag/4.16.1"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-6022","url":"https://osv.dev/vulnerability/GO-2026-6022"}],"summary":"Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim in github.com/cloudreve/Cloudreve"}