Cloudreve Admin.Read OAuth tokens can trigger server-side node test requests

## Summary Cloudreve exposes two admin node test endpoints under the `Admin.Read` OAuth scope. These endpoints accept a

历史摘要 · 未重新核验 · GitHub Advisory

frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow

## Summary An integer-overflow vulnerability in the frp server's optional SSH Tunnel Gateway lets any unauthenticated r

历史摘要 · 未重新核验 · GitHub Advisory

Kite Kubernetes proxy path traversal allows authenticated users to bypass RBAC and read cluster-wide resources

## Summary Kite versions 0.6.9 through 0.14.0 authorize Kubernetes proxy requests against the pod or service identified

历史摘要 · 未重新核验 · GitHub Advisory

Cloudreve WOPI view sessions can write files and WOPI access token secret is ignored

CVE-2026-62323

## Summary Cloudreve WOPI access tokens are generated as `.`, but the WOPI middleware validates only the session id pre

历史摘要 · 未重新核验 · GitHub Advisory

webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsules

CVE-2026-57497

## Summary An attacker can cause excessive memory allocation in webtransport-go by sending an unknown WebTransport caps

历史摘要 · 未重新核验 · GitHub Advisory

Cloudreve OAuth Admin.Read scope can update OneDrive storage policy credentials

CVE-2026-55502

## Summary Cloudreve 4.16.1 has an OAuth scope authorization bypass in the admin storage policy routes. An OAuth bearer

历史摘要 · 未重新核验 · GitHub Advisory

Cloudreve: Broken Access Control in file event stream: a single-file share recipient is subscribed to the owner's parent folder and receives activity events for unshared siblings

CVE-2026-55499

## Summary When an authenticated recipient of a **single-file** share opens the file event stream (`GET /api/v4/file/e

历史摘要 · 未重新核验 · GitHub Advisory

Cloudreve: Denial of Service - Image decompression / pixel bomb in thumbnail & avatar decoding crashes the server

CVE-2026-55497

## Summary Cloudreve's built-in image processor decodes user-supplied images with Go's standard-library decoders (`imag

历史摘要 · 未重新核验 · GitHub Advisory

Cloudreve: Information Exposure in `GET /api/v4/user/search`: `SearchActive` omits the active-status predicate, leaking inactive/banned account emails

CVE-2026-55496

## Summary `GET /api/v4/user/search` is available to any logged-in user. The service calls `userClient.SearchActive`,

历史摘要 · 未重新核验 · GitHub Advisory

Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account

CVE-2026-55495

## Summary Cloudreve's WOPI `PUT_RELATIVE` handler treats `X-WOPI-SuggestedTarget` as a path, not a filename. It split

历史摘要 · 未重新核验 · GitHub Advisory

gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

Multiple security vulnerabilities have been identified and addressed in grpc-go affecting the xDS RBAC authorization eng

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface

CVE-2026-20779

### Summary I'm reporting **two related TOTP one-time-use defects** in Gitea that survive the CVE-2021-45331 fix. The 2

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints

CVE-2026-58429

### Summary A personal access token restricted with the public-only scope can still retrieve private organization member

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

CVE-2026-59765

### Summary Gitea has robust SSRF protection via `hostmatcher.NewDialContext()` for webhook and migration clone URLs, w

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: Webhook Authorization Header Returned in Plaintext via API

CVE-2026-58511

## Summary The `ToHook()` function in `services/webhook/general.go` decrypts the webhook's `HeaderAuthorizationEncrypte

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs

CVE-2026-57897

**Author:** Prakhar Porwal **Date:** 2026-05-24 **Target:** Gitea (self-hosted Git service) **Branch tested:** `main` @

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

CVE-2026-58510

## Summary GHSA-8fwc-qjw5-rvgp ("Gitea may send release notification emails for private repositories to users whose acc

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: Public-only API token restriction is not enforced on team API routes

CVE-2026-58431

### Summary Gitea's `/api/v1/teams/{id}` API routes do not correctly enforce the `public-only` access token restriction

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

CVE-2026-58427

## Summary PR #38145 fixed ListPublicMembers and IsPublicMember but missed ListMembers. Any authenticated user can enum

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

CVE-2026-58422

### Summary The OAuth2 sign-in callback in Gitea 1.26.1 unconditionally re-enables a locally-disabled account whenever

历史摘要 · 未重新核验 · GitHub Advisory