Lucene search

K
hackeroneRtodH1:1200815
HistoryMay 18, 2021 - 12:34 p.m.

Nextcloud: Federated share accepting/declining is not logged in audit log

2021-05-1812:34:55
rtod
hackerone.com
9

0.001 Low

EPSS

Percentile

26.0%

In relation to https://hackerone.com/reports/1177353

  1. Enable the audit log
  2. Share a file to a federated user
  3. So far all looks good in the log
  4. the recipient checks either accepts or declines the share
  5. There is no line regarding this in the logs.

Impact

The audit log is used to get a full trail of the actions which is now incompletely. With possible important information.
It seems to be also listed on https://portal.nextcloud.com/article/using-the-audit-log-44.html
From my point of view a declined share is unshared again.

0.001 Low

EPSS

Percentile

26.0%