Read the docs
TI-2026-81399 Aliases CVE-2026-82983

Nextcloud Tables share list exposed to users with read-only access

Priority LOW 15CWE-200Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Will not fix Red Hat: no fix planned

Attack profile from CVSS 3.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-200.

Summary

CVE-2026-82983 affects Nextcloud Tables from 0.8.1 through 2.0.0. The share-listing endpoint GET /apps/tables/share/table/{tableId} does not check that the requesting user has manage-level permission on the table before it returns every share recipient (users, groups and teams) with their permission levels. A user granted only read-data access can call the endpoint directly to list everyone the table is shared with and their access levels. The table data itself stays limited to what the read-data grant allows; the weakness is CWE-200, rated 3.3 (LOW) under CVSS 3.0.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level permission on the table before returning the full list of share recipients (users, groups, and teams) along with their permission levels. A user who was only granted read-data access to a table, and who is correctly prevented from seeing this information in the web UI, could call the endpoint directly to enumerate everyone the table is shared with and their access levels. This does not expose the table's data itself beyond what the read-data grant already permits, only the list of share recipients and their permission levels.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00114 1st percentileScored 2026-11-07
Fix Will not fix Red Hat: no fix planned

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nextcloudTables0.8.1 – 2.0.0—No fix listedCNA
  • Tables Vendornextcloud Affected 0.8.1 – 2.0.0 Fixed in — No fix listed CNA

Remediation

No fixed version is listed for Nextcloud Tables 0.8.1 through 2.0.0. Until a fix is released, limit read-data grants on sensitive tables to users who need them.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Out of support scope

Timeline

  1. 2026-10-27 Threatist record created from CVE-2026-82983
  2. 2026-10-29 Affected versions changed · Red Hat
  3. 2026-10-29 CVSS score added · Red Hat
  4. 2026-11-04 CISA SSVC decision points changed

References

Other 1

  • TI-2026-18211 Windmill < 1.615.0 Operator Role Missing Authorization Checks RCE CVSS 4.0HIGH 8.7
  • TI-2023-14838 NextCloud Cookbook's pull-checks.yml workflow is vulnerable to OS Command Injection CVSS 3.1HIGH 8.8
  • TI-2022-08650 Command Injection in Appointment Emails for Nextcloud Calendar CVSS 3.1CRITICAL 9.8
  • TI-2023-20855 Users can delete external storage mount points CVSS 3.1HIGH 7.7
  • TI-2023-11091 Nextcloud download permissions can be changed by resharer CVSS 3.1HIGH 7.5
  • TI-2023-10624 Nextcloud Server vulnerable to SSRF via filter bypass due to lax checking on IPs CVSS 3.1MEDIUM 5.3
See all 401 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences