CVE-2026-54560: Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim

Cloudreve’s OAuth access tokens can bypass OAuth scope enforcement.

This does not appear to be the intended design. The documentation describes OAuth client permissions/scopes, the API has an insufficient-scope error code, and the code comments say RequiredScopes(...) should verify scopes when a token has scopes, while skipping checks only for non-scoped session-based authentication.

However, OAuth access tokens are issued without the OAuth client_id claim. Later, the JWT verifier only loads scopes into the request context when claims.ClientID != "". Because the OAuth access token has no client_id, its scopes are not loaded, and RequiredScopes(...) treats the request like a non-scoped first-party/session token and skips scope checks.

As a result, a low-scope OAuth access token, for example one granted only openid, can call APIs requiring higher scopes such as file, share, workflow, user setting, WebDAV account, and potentially admin scopes when the authorizing user is an administrator.