Lucene search

K
hackeroneDetroitsmashH1:145950
HistoryJun 19, 2016 - 11:33 p.m.

Nextcloud: Uploading files to a folder where invited user don't have any EDIT privilege

2016-06-1923:33:59
detroitsmash
hackerone.com
27

EPSS

0.001

Percentile

44.9%

Hi,

Any invited user to a shared folder with no edit privilege can create files in it through copy feature of Nextclod android app.

Steps to reproduce it

  • Create any folder and invite a user in it without any edit privilege.
  • Now login from invited user account through android app.
  • Copy any file from your nextcloud root folder to shared folder.
  • Check nextcloud web app!! Copied file will show in shared folder

Thanks

EPSS

0.001

Percentile

44.9%