PT-2026-45526 · Nextcloud · Nextcloud Server+1
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Nextcloud Server versions 32.0.0 through 32.0.8
Nextcloud Server versions 33.0.0 through 33.0.2
Nextcloud Enterprise Server versions prior to 33.0.3
Nextcloud Enterprise Server versions prior to 32.0.9
Nextcloud Enterprise Server versions prior to 31.0.14.5
Nextcloud Enterprise Server versions prior to 30.0.17.9
Nextcloud Enterprise Server versions prior to 29.0.16.16
Nextcloud Enterprise Server versions prior to 28.0.14.17
Nextcloud Enterprise Server versions prior to 27.1.11.5
Description
An authenticated attacker can access attachments of link shares by using a known share token, which allows them to bypass password protection or download restrictions. This issue affects files shared directly if the attacker knows a
documentId they own in addition to the share token. For shared folders, the attacker must know or guess the documentId of a file within that folder. The attacker is limited to extracting attachments and cannot access the shared file or folder itself.Recommendations
Upgrade Nextcloud Server to version 32.0.9 or 33.0.3.
Upgrade Nextcloud Enterprise Server to version 27.1.11.5, 28.0.14.17, 29.0.16.16, 30.0.17.9, 31.0.14.5, 32.0.9, or 33.0.3.
Exploit
Fix
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Nextcloud Enterprise Server
Nextcloud Server