End to end encryption folder locking is not properly protected

Description

Impact

The Nextcloud End-to-End Encryption app before 1.5.3, 1.6.3 and 1.7.1 allowed any authenticated users to lock files of other users. Resulting in a temporary denial of service attack.

Patches

It is recommended that the Nextcloud End-To-End Encryption App is upgraded to 1.5.3, 1.6.3 or 1.7.1.

Workarounds

None.

References

• HackerOne

For more information

If you have any questions or comments about this advisory:

• Create a post in nextcloud/security-advisories
• Customers: Open a support ticket at support.nextcloud.com