Nextcloud: Critical broken access control: API-only delegated admin can enumerate all Team Folders and grant access to arbitrary groups

A critical broken access control vulnerability was discovered in the Team Folders application. An API-only delegated administrator was able to bypass folder-level authorization and grant access to arbitrary groups through an unprotected endpoint. Folder IDs were found to be predictable through...