CVE-2020-8223

A logic error in Nextcloud Server 19.0.0 caused a privilege escalation allowing malicious users to reshare with higher permissions than they got assigned themselves...

CVE-2020-8182: Improper Access Control

Improper access control in Nextcloud Deck 0.8.0 allowed an attacker to reshare boards shared with them with more permissions than they had themselves...

CVE-2020-8223: Improper Privilege Management

A logic error in Nextcloud Server 19.0.0 caused a privilege escalation allowing malicious users to reshare with higher permissions than they got assigned themselves...

CVE-2019-15621

Improper permissions preservation in Nextcloud Server 16.0.1 causes sharees to be able to reshare with write permissions when sharing the mount point of a share they received, as a public link...

Input validation

Improper permissions preservation in Nextcloud Server 16.0.1 causes sharees to be able to reshare with write permissions when sharing the mount point of a share they received, as a public link...

CVE-2019-15621

Nextcloud Server 16.0.1 is affected by CVE-2019-15621: an improper permissions preservation enables sharees to reshare with write permissions when sharing the mount point of a received share via a public link. Root cause is a permissions preservation flaw in the sharing flow; exploitation details...

Nextcloud: Delete permission can be added on reshare

user0 creates folder /test user0 creates file /test/file.txt user0 shares folder /test with user1 with read+share permissions 17 user1 receives the folder /test and can read-download /test/file.txt but not delete - good user1 uses the sharing API to share folder /test with user2, and specifies...

Improper permission preservation on reshares (NC-SA-2020-012)

Improper permissions preservation in Nextcloud Server 16.0.1 causes sharees to be able to reshare with write permissions when sharing the mount point of a share they received, as a public link...

Bypass received read-only share permissions using read-write reshare - ownCloud

User can upload and modify the link share contents even though the original sharer has only read-only access. Affected Software ownCloud Server 9.1.2 CVE-2016-???? core/c7c1b61e10514fe4d8efbaf1156501dd795e7ac1 ownCloud Server 9.0.6 CVE-2016-???? core/65af3785ab5e1d780598874b3553c93767447f1f Actio...

Server: Bypass received read-only share permissions using read-write reshare

User can upload and modify the link share contents even though the original sharer has only read-only access. For more information please consult the official advisory. This advisory is licensed CC BY-SA 4.0...