Vulnerabilities

When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be called directly, allowing…

Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table.

A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as confidential.

A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token.

A public shared collective always allowed recipients of the link to create pages.

App passwords were allowed to bypass password confirmation on sensitive endpoints.

A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user.

The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level permission on the table before returning the full list of share recipients (users,…

The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission.

File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database.

The emoji field in the page emoji update endpoint does not properly validate user input.

After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of.

The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewing the album, rather than the album owner's configuration.

Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcl…

The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has permission to manage the referenced board.

The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after they reviewed it.

A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed API/REST-only delegated administrators to bypass folder-level authorization controls.

Any authenticated user can lock or unlock files they do not own by targeting absolute WebDAV paths of other users.

Nextcloud is an open source content collaboration platform.

Nextcloud is an open source content collaboration platform.

Nextcloud is an open source content collaboration platform.

Nextcloud is an open source content collaboration platform.

Nextcloud is an open source content collaboration platform.

Nextcloud is an open source content collaboration platform.

Nextcloud is an open source content collaboration platform.