Lucene search

K
hackeroneMikaelgundersenH1:1675014
HistoryAug 19, 2022 - 7:36 p.m.

Nextcloud: Profile of disabled user stays accessible

2022-08-1919:36:52
mikaelgundersen
hackerone.com
$100
13
nextcloud
user profile
accessibility
data exposure
bug bounty

EPSS

0.001

Percentile

30.8%

Userprofiles of disabled users keep staying accessible. on DOMAIN/u/USERID
This is quite undesirable as this user has no way to clear or modify this data in case they do not want it exposed anymore.
I’d assume profiles of disabled users would not be visible to ensure they can always be in control of their own data.

Impact

exposure of user info that they can’t control anymore.

EPSS

0.001

Percentile

30.8%