CVE-2023-22471

CVE-2023-22471 affects Nextcloud Deck (Nextcloud Deck app) and is caused by broken access control that allows a user to delete attachments of other users. Public docs list vulnerable versions: Deck app prior to 1.6.5, prior to 1.7.3, and prior to 1.8.2. Impact is deletion of attachments across ca...

CVE-2022-24906

CVE-2022-24906 affects Nextcloud Deck: an error in deleting deck card attachments reveals the full application path to unauthorized users. Documented impact is information disclosure (full path). Affected product: Nextcloud Deck (Nextcloud app); vulnerable component: deck attachment deletion flow...

CVE-2019-15619

CVE-2019-15619 affects Nextcloud Suite components: Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3, and Nextcloud Deck 0.6.5. The root cause is improper neutralization of file names, conversation names and board names, leading to cross-site scripting when linking these items within a project. Docum...

CVE-2020-8297

CVE-2020-8297 affects Nextcloud Deck prior to 1.0.2, with an insecure direct object reference (IDOR) that lets a user with a duplicate username access deck data belonging to a previously deleted user. The issue stems from access control handling in the Deck app and is confirmed by multiple source...

CVE-2024-37883

CVE-2024-37883 affects Nextcloud Deck (kanban tool integrated with Nextcloud). A user with access to a deck board could access comments and attachments of cards that were already deleted, indicating a disclosure issue due to Deck’s handling of deleted items. Affected versions are prior to upgrade...

CVE-2020-8179

CVE-2020-8179 affects Nextcloud Deck 1.0.0. The root cause is an improper access control in the deck task/move flow: updating a card’s stackId via /apps/deck/cards/{id} does not enforce that the destination belongs to the requester, allowing an attacker to inject tasks into another user’s deck. T...

CVE-2020-8235

CVE-2020-8235 affects Nextcloud Deck 1.0.4, where missing access control enables an insecure direct object reference to view all attachments. Root cause: inadequate access checks when accessing attachments from the Deck task view, leading to exposure of user-owned files. Public references in the ...