Users can make external storage mount points inaccessible for other users

Description

Impact

A malicious user could update any personal or global external storage, making them inaccessible for everyone else as well.

Patches

It is recommended that the Nextcloud Server is upgraded to 25.0.13, 26.0.8 or 27.1.3
It is recommended that the Nextcloud Enterprise Server is upgraded to 20.0.14.16, 21.0.9.13, 22.2.10.15, 23.0.12.12, 24.0.12.8, 25.0.13, 26.0.8 or 27.1.3

Workarounds

• Disable app files_external - Also makes the external storage inaccessible but retains the configurations until a patched version has been deployed

References

• HackerOne
• PullRequest

For more information

If you have any questions or comments about this advisory:

• Create a post in nextcloud/security-advisories
• Customers: Open a support ticket at portal.nextcloud.com