nextcloud vulnerabilities

When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the…

Nextcloud · Server

Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely — there…

Nextcloud · server

A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as…

Nextcloud · Files Confidential

A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token.

Nextcloud · Richdocuments

A public shared collective always allowed recipients of the link to create pages.

Nextcloud · Collectives

App passwords were allowed to bypass password confirmation on sensitive endpoints.

Nextcloud · Server

A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user. A low…

Nextcloud · whiteboard

The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level permission on the…

Nextcloud · Tables

The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have…

Nextcloud · Tables

File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database.

Nextcloud · Server