GHSA-hq88-5x99-x3gf

## Summary

Cloudreve 4.16.1 has an OAuth scope authorization bypass in the admin storage policy routes. An OAuth bearer token scoped to `Admin.Read` but not `Admin.Write` can call `POST /api/v4/admin/policy/oauth/signin` and update OneDrive storage policy credentials.

The route is inside the admin group that requires `Admin.Read`, but it does not add the local `Admin.Write` guard used by sibling policy mutation routes. Its handler persists attacker-supplied `secret` and `app_id` values into the selected OneDrive storage policy before returning an OAuth URL.

## Impact

An OAuth application that was granted only read-only admin scope can modify persistent storage backend configuration for a OneDrive policy. This can break the storage backend, replace the stored application secret and app ID, and redirect future OAuth setup for that policy to attacker-controlled application parameters. The attack crosses the intended OAuth scope boundary because `Admin.Write` is required for sibling storage policy mutation routes.

## Reproduction

Preconditions:

1. The instance has a OneDrive storage policy. 2. An admin user authorizes an OAuth client for `Admin.Read` but not `Admin.Write`. 3. The OAuth client obtains a bearer access token for that admin user.

Send the following request with that read-only admin scoped token:

```http POST /api/v4/admin/policy/oauth/signin HTTP/1.1 Authorization: Bearer <admin OAuth token scoped to Admin.Read only> Content-Type: application/json

{"id":1,"secret":"attacker-secret","app_id":"attacker-app-id"} ```

Expected secure result: the request is rejected with an insufficient-scope error because it changes storage policy credentials.

Actual result: the request reaches `AdminOdOAuthURL`, and `GetOauthRedirectService.GetOAuth()` persists the supplied values to the storage policy.

## Root cause

`routers/router.go` applies `RequiredScopes(types.ScopeAdminRead)` to the authenticated admin route group. Sibling policy mutation routes add local `RequiredScopes(types.ScopeAdminWrite)` guards, for example policy create, policy update, CORS creation, OAuth callback, and policy delete.

The OneDrive OAuth signin route is missing that local write-scope guard:

```go oauth.POST("signin", controllers.FromJSON[adminsvc.GetOauthRedirectService](adminsvc.GetOauthRedirectParamCtx{}), controllers.AdminOdOAuthURL, ) ```

The handler performs a persistent write in `service/admin/policy.go`:

```go policy.Settings.OauthRedirect = routes.MasterPolicyOAuthCallback(dep.SettingProvider().SiteURL(c)).String() policy.SecretKey = service.Secret policy.BucketName = service.AppID policy, err = storagePolicyClient.Upsert(c, policy) ```

The request fields `secret` and `app_id` come directly from the caller.

## PoC evidence

A focused scope test confirmed that a request context with only `Admin.Read` fails `CheckScope(c, types.ScopeAdminWrite)`, while `Admin.Write` implies `Admin.Read`. Therefore write routes must add `RequiredScopes(types.ScopeAdminWrite)` explicitly. The vulnerable route does not do so, and the handler writes the policy fields shown above.

## Remediation

Add `middleware.RequiredScopes(types.ScopeAdminWrite)` to `oauth.POST("signin", ...)` before the JSON handler. Consider auditing other admin test routes that perform outbound network or mail actions under only `Admin.Read`, but this persistent credential update should be fixed first.