402 matches found
Unnecessary parts of WOPI configration returned in richdocuments
None...
Public collectives allow to create pages
None...
SSRF on Nextcloud Whiteboard Application via Recordings to Unauthorised Access to Whiteboards
None...
Tables application does not respect sharing limitations set by admin
None...
Users with read-only access to a Nextcloud Table can enumerate its share recipients via the Tables API
None...
Unauthorized users can enumerate internal team resources via the Teams API when a team is visible to everyone
None...
Files Confidential tagging can be bypassed with # in filename
None...
Public shares remain accessible via alternate endpoints after owner account is disabled
None...
No password confirmation required when using apptoken on sensitive endpoint
None...
Unauthenticated Persistent Denial-of-Service via Federated Share Injection
None...
Privilege escalation in team folders allowing API-only delegated admins to grant unauthorized access to team folders
None...
Team membership information returned on API level based on ID
None...
Shared smart albums in the Photos app can expose files outside the album owner's configured source folders
None...
Write-share collaborator can place a TYPE_TOKEN lock that permanently denies the file owner
None...
Improper input validation in emoji field breaks sidebar in Collectives
None...
ImageMagick vulnerability abusable via previews of malicious files
None...
Mail contact autocomplete bypasses administrator-configured user enumeration restrictions
None...
View-Only shares on External Storage or Team Folders are always writeable
None...
Propfind requests for file comments allowed to load comments for other files
None...
Two-Factor Authentication Bypass via Pending Session Token Replay
None...
Tables app allows limited SQLi in ORDER BY with malicious sort order argument for Table Views
None...
Bypass of second factor authentication on DAV endpoints by reusing a pre-2FA session ID
None...
Deleting a Forms collaborator share leaves uploaded response files accessible through a lingering Files share
None...
Information Disclosure of view filter metadata via Broken Sensitive Data Masking in ViewService
None...
SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution
None...
Calendar app leaked user identifiers via attendee suggestion endpoint
None...
Hidden Public Link creation when sharing to a Team External Member
None...
Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owner
None...
Valid share tokens allow to access tempory upload files of share owner
None...
Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDC
None...
Private circle can be added to another circle via API
None...
View-only guests could see deleted Collectives pages in the trashbin
None...
PIN bypass in PassCodeActivity via back button
None...
Wrong condition in the User OIDC app's LdapService allowed deleted LDAP users to authenticate
None...
Logged-in user bypasses share password and download restrictions on Text attachments via documentId
None...
Files Lock app allows users to lock and unlock files of other users
None...
Cross-Account Calendar Takeover via Unauthorized Group-Member-Set Update
None...
Open Redirect in user_oidc login flow via protocol-relative URL bypass
None...
Limited path traversal via template API if using `{lang}` in config
None...
fileId parameter reveals workflow associations in Nextcloud Approval app
None...
Authorization bypass in approval feature allows unauthorized file sharing with approvers
None...
Missing permission check for reading form submissions
None...
Unauthorized force-mute from missing permission check when using internal signaling
None...
ACL Rename Permission Bypass in Team Folders Allows Unauthorized File Renames
None...
Remote code execution in Nextcloud Flow via vulnerable Windmill version
None...
Calendar app used predictable proposal participant tokens
None...
XSS in SVG images when opened outside of Nextcloud
None...
Mail stored HTML injection in subject text
None...