CVE-2026-104189

The 3D Viewer for Nextcloud (versions 1.7.9 through 3.3.1) contains a vulnerability where share passwords are not enforced when streaming 3D models via public links. The root cause is that PublicFileController extends OCP\AppFramework\Controller instead of OCP\AppFramework\PublicShareController, ...

CVE-2026-104189 3Dviewer-Nextcloud: Share password not enforced when streaming 3D models from a public link share

The 3D Viewer for Nextcloud is a comprehensive 3D model viewer application for Nextcloud that supports multiple 3D file formats. In versions 1.7.9 through 3.3.1, the app's public file endpoint performed no share authorization. Anyone who knows a share token could read the shared file's contents...