Users can delete old versions of read-only shared files

Description

Impact

A malicious user was able to send delete requests for old versions of files they only got shared with read permissions.

Patches

It is recommended that the Nextcloud Server is upgraded to 26.0.12 or 27.1.7 or 28.0.3
It is recommended that the Nextcloud Enterprise Server is upgraded to 25.0.13.7 or 26.0.12 or 27.1.7 or 28.0.3

Workarounds

• Disable Versions app

References

• HackerOne
• PullRequest

For more information

If you have any questions or comments about this advisory:

• Create a post in nextcloud/security-advisories
• Customers: Open a support ticket at portal.nextcloud.com