Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-87897 (GCVE-0-2026-87897)

Vulnerability from nvd – Published: 2026-10-27 16:15 – Updated: 2026-11-04 17:59

Summary

A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user. A low privileged attacker could continually exploit this vulnerability to leak the JWT authentication token for another user when they start a recording, which then enables the attacker read/write access to the victim's Whiteboard.

Severity

4.6 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 17:58 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

hackerone CNA under the mitre root

CNA scorecard D 60/100 over 214 records in the last 180 days details

References

1 reference

URL	Tags
https://hackerone.com/reports/3576823

Impacted products

1 product

Vendor	Product	Version
Nextcloud	whiteboard	Affected: 1.0.0 , < 1.0.0 (semver)

Credits

alex-elttam (alex-elttam)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-87897",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T17:58:52.045220Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T17:59:02.350Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "whiteboard",
          "vendor": "Nextcloud",
          "versions": [
            {
              "lessThan": "1.0.0",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "alex-elttam (alex-elttam)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user. A low privileged attacker could continually exploit this vulnerability to leak the JWT authentication token for another user when they start a recording, which then enables the attacker read/write access to the victim\u0027s Whiteboard."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T16:15:34.742Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/3576823"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-87897",
    "datePublished": "2026-10-27T16:15:34.742Z",
    "dateReserved": "2026-09-09T15:00:00.573Z",
    "dateUpdated": "2026-11-04T17:59:02.350Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-82986 (GCVE-0-2026-82986)

Vulnerability from nvd – Published: 2026-10-27 16:15 – Updated: 2026-11-04 17:47

Summary

The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission.

Severity

4.6 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 17:47 UTC

CWE

CWE-284 - Improper Access Control - Generic

Assigner

hackerone CNA under the mitre root

CNA scorecard D 60/100 over 214 records in the last 180 days details

References

1 reference

URL	Tags
https://hackerone.com/reports/3642236

Impacted products

1 product

Vendor	Product	Version
Nextcloud	Tables	Affected: 0.6.4 , ≤ 1.0.0 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-82986",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T17:47:39.070313Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T17:47:48.887Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Tables",
          "vendor": "Nextcloud",
          "versions": [
            {
              "lessThanOrEqual": "1.0.0",
              "status": "affected",
              "version": "0.6.4",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn\u0027t have that permission."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control - Generic",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T16:15:34.671Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/3642236"
        }
      ],
      "workarounds": [
        {
          "lang": "en",
          "value": "The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn\u0027t have that permission."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-82986",
    "datePublished": "2026-10-27T16:15:34.671Z",
    "dateReserved": "2026-08-31T15:00:00.544Z",
    "dateUpdated": "2026-11-04T17:47:48.887Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-82984 (GCVE-0-2026-82984)

Vulnerability from nvd – Published: 2026-10-27 16:15 – Updated: 2026-11-04 20:25

Summary

When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be called directly, allowing any authenticated non-member to enumerate the team's internal resources and their identifiers. This does not grant access to the contents of the discovered resources themselves, only their existence, names, and identifiers.

Severity

4.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 19:32 UTC

CWE

CWE-284 - Improper Access Control - Generic

Assigner

hackerone CNA under the mitre root

CNA scorecard D 60/100 over 214 records in the last 180 days details

References

1 reference

URL	Tags
https://hackerone.com/reports/3511955

Impacted products

1 product

Vendor	Product	Version
Nextcloud	Server	Affected: 32.0.0 , ≤ 33.0.0 (semver)

Credits

_dha (yoyomiski)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-82984",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T19:32:09.273078Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T20:25:03.302Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Server",
          "vendor": "Nextcloud",
          "versions": [
            {
              "lessThanOrEqual": "33.0.0",
              "status": "affected",
              "version": "32.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "_dha (yoyomiski)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When a team was configured as \"visible to everyone\", the web UI correctly blocked non-members from viewing the team (\"You are not a member of ...\"), but the resources API endpoint could still be called directly, allowing any authenticated non-member to enumerate the team\u0027s internal resources and their identifiers.\n\nThis does not grant access to the contents of the discovered resources themselves, only their existence, names, and identifiers."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control - Generic",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T16:15:34.831Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/3511955"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-82984",
    "datePublished": "2026-10-27T16:15:34.831Z",
    "dateReserved": "2026-08-31T15:00:00.544Z",
    "dateUpdated": "2026-11-04T20:25:03.302Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-82983 (GCVE-0-2026-82983)

Vulnerability from nvd – Published: 2026-10-27 16:15 – Updated: 2026-11-04 17:53

Summary

The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level permission on the table before returning the full list of share recipients (users, groups, and teams) along with their permission levels. A user who was only granted read-data access to a table, and who is correctly prevented from seeing this information in the web UI, could call the endpoint directly to enumerate everyone the table is shared with and their access levels. This does not expose the table's data itself beyond what the read-data grant already permits, only the list of share recipients and their permission levels.

Severity

3.3 (Low)


                        
                          CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 17:52 UTC

CWE

CWE-200 - Information Disclosure

Assigner

hackerone CNA under the mitre root

CNA scorecard D 60/100 over 214 records in the last 180 days details

References

1 reference

URL	Tags
https://hackerone.com/reports/3524971

Impacted products

1 product

Vendor	Product	Version
Nextcloud	Tables	Affected: 0.8.1 , ≤ 2.0.0 (semver)

Credits

_dha (yoyomiski)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-82983",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T17:52:46.125191Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T17:53:04.349Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Tables",
          "vendor": "Nextcloud",
          "versions": [
            {
              "lessThanOrEqual": "2.0.0",
              "status": "affected",
              "version": "0.8.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "_dha (yoyomiski)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Tables app\u0027s share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level permission on the table before returning the full list of share recipients (users, groups, and teams) along with their permission levels. A user who was only granted read-data access to a table, and who is correctly prevented from seeing this information in the web UI, could call the endpoint directly to enumerate everyone the table is shared with and their access levels.\n\nThis does not expose the table\u0027s data itself beyond what the read-data grant already permits, only the list of share recipients and their permission levels."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Information Disclosure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T16:15:34.683Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/3524971"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-82983",
    "datePublished": "2026-10-27T16:15:34.683Z",
    "dateReserved": "2026-08-31T15:00:00.543Z",
    "dateUpdated": "2026-11-04T17:53:04.349Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-77173 (GCVE-0-2026-77173)

Vulnerability from nvd – Published: 2026-10-27 16:15 – Updated: 2026-11-04 20:25

Summary

A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as confidential.

Severity

4.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 19:32 UTC

CWE

CWE-284 - Improper Access Control - Generic

Assigner

hackerone CNA under the mitre root

CNA scorecard D 60/100 over 214 records in the last 180 days details

References

1 reference

URL	Tags
https://hackerone.com/reports/3682163

Impacted products

1 product

Vendor	Product	Version
Nextcloud	Files Confidential	Affected: 3.3.0 , ≤ 5.0.0 (semver)

Credits

XavLimSG (xavlimsg)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77173",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T19:32:07.896827Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T20:25:17.386Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Files Confidential",
          "vendor": "Nextcloud",
          "versions": [
            {
              "lessThanOrEqual": "5.0.0",
              "status": "affected",
              "version": "3.3.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "XavLimSG (xavlimsg)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as confidential."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control - Generic",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T16:15:34.777Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/3682163"
        }
      ],
      "workarounds": [
        {
          "lang": "en",
          "value": "Change config setting: Add # to forbidden_filename_characters and rename all affected files"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-77173",
    "datePublished": "2026-10-27T16:15:34.777Z",
    "dateReserved": "2026-08-20T15:00:00.607Z",
    "dateUpdated": "2026-11-04T20:25:17.386Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-77172 (GCVE-0-2026-77172)

Vulnerability from nvd – Published: 2026-10-27 16:15 – Updated: 2026-11-04 17:58

Summary

App passwords were allowed to bypass password confirmation on sensitive endpoints.

Severity

5.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 17:58 UTC

CWE

CWE-269 - Improper Privilege Management

Assigner

hackerone CNA under the mitre root

CNA scorecard D 60/100 over 214 records in the last 180 days details

References

1 reference

URL	Tags
https://hackerone.com/reports/3566607

Impacted products

1 product

Vendor	Product	Version
Nextcloud	Server	Affected: 32.0.0 , ≤ 34.0.0 (semver)

Credits

Nicholas Carlini (npc)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77172",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T17:58:16.970924Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T17:58:26.808Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Server",
          "vendor": "Nextcloud",
          "versions": [
            {
              "lessThanOrEqual": "34.0.0",
              "status": "affected",
              "version": "32.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nicholas Carlini (npc)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "App passwords were allowed to bypass password confirmation on sensitive endpoints."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T16:15:34.765Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/3566607"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-77172",
    "datePublished": "2026-10-27T16:15:34.765Z",
    "dateReserved": "2026-08-20T15:00:00.607Z",
    "dateUpdated": "2026-11-04T17:58:26.808Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-77171 (GCVE-0-2026-77171)

Vulnerability from nvd – Published: 2026-10-27 16:15 – Updated: 2026-11-04 20:25

Summary

A public shared collective always allowed recipients of the link to create pages.

Severity

3.5 (Low)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 19:32 UTC

CWE

CWE-284 - Improper Access Control - Generic

Assigner

hackerone CNA under the mitre root

CNA scorecard D 60/100 over 214 records in the last 180 days details

References

1 reference

URL	Tags
https://hackerone.com/reports/3533697

Impacted products

1 product

Vendor	Product	Version
Nextcloud	Collectives	Affected: 4.0.0 , ≤ 4.0.0 (semver)

Credits

_dha (yoyomiski)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77171",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T19:32:04.896377Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T20:25:28.802Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Collectives",
          "vendor": "Nextcloud",
          "versions": [
            {
              "lessThanOrEqual": "4.0.0",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "_dha (yoyomiski)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A public shared collective always allowed recipients of the link to create pages."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control - Generic",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T16:15:34.770Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/3533697"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-77171",
    "datePublished": "2026-10-27T16:15:34.770Z",
    "dateReserved": "2026-08-20T15:00:00.606Z",
    "dateUpdated": "2026-11-04T20:25:28.802Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-77167 (GCVE-0-2026-77167)

Vulnerability from nvd – Published: 2026-10-27 16:15 – Updated: 2026-11-04 20:25

Summary

Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely — there is no automatic cleanup mechanism. Three distinct denial-of-service conditions follow from this write primitive, all triggered from the same unauthenticated source and all self-renewing on a 24-hour cycle for as long as the injected rows remain in the database.

Severity

7.5 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 20:07 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

hackerone CNA under the mitre root

CNA scorecard D 60/100 over 214 records in the last 180 days details

References

1 reference

URL	Tags
https://hackerone.com/reports/3679640

Impacted products

1 product

Vendor	Product	Version
Nextcloud	server	Affected: 22.0.0 , ≤ 34.0.0 (semver)

Credits

ncsc_nl

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77167",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T20:07:41.893986Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T20:25:10.944Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "server",
          "vendor": "Nextcloud",
          "versions": [
            {
              "lessThanOrEqual": "34.0.0",
              "status": "affected",
              "version": "22.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "ncsc_nl"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely \u2014 there is no automatic cleanup mechanism. Three distinct denial-of-service conditions follow from this write primitive, all triggered from the same unauthenticated source and all self-renewing on a 24-hour cycle for as long as the injected rows remain in the database."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400 Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T16:15:34.778Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/3679640"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-77167",
    "datePublished": "2026-10-27T16:15:34.778Z",
    "dateReserved": "2026-08-20T15:00:00.606Z",
    "dateUpdated": "2026-11-04T20:25:10.944Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-67400 (GCVE-0-2026-67400)

Vulnerability from nvd – Published: 2026-10-27 16:15 – Updated: 2026-11-04 20:25

Summary

A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token.

Severity

3.5 (Low)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 19:32 UTC

CWE

CWE-284 - Improper Access Control - Generic

Assigner

hackerone CNA under the mitre root

CNA scorecard D 60/100 over 214 records in the last 180 days details

References

1 reference

URL	Tags
https://hackerone.com/reports/3568116

Impacted products

1 product

Vendor	Product	Version
Nextcloud	Richdocuments	Affected: 11.0.0 , ≤ 11.0.0 (semver)

Credits

Ibrahim el zein (bornwinnerrr)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-67400",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T19:32:06.273605Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T20:25:23.074Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Richdocuments",
          "vendor": "Nextcloud",
          "versions": [
            {
              "lessThanOrEqual": "11.0.0",
              "status": "affected",
              "version": "11.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ibrahim el zein  (bornwinnerrr)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control - Generic",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T16:15:34.773Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/3568116"
        }
      ],
      "workarounds": [
        {
          "lang": "en",
          "value": "Disable app richdocuments"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-67400",
    "datePublished": "2026-10-27T16:15:34.773Z",
    "dateReserved": "2026-07-29T15:00:02.294Z",
    "dateUpdated": "2026-11-04T20:25:23.074Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-77166 (GCVE-0-2026-77166)

Vulnerability from nvd – Published: 2026-09-21 15:25 – Updated: 2026-09-21 18:43

Summary

The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items.

Severity

2.4 (Low)


                        
                          CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-21 18:42 UTC

CWE

CWE-840 - Business Logic Errors

Assigner

hackerone CNA under the mitre root

CNA scorecard D 60/100 over 214 records in the last 180 days details

References

1 reference

URL	Tags
https://hackerone.com/reports/3599470

Impacted products

1 product

Vendor	Product	Version
Nextcloud	Collectives	Affected: 3.2.1 , ≤ 3.5.0 (semver)

Credits

_dha (yoyomiski)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77166",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T18:42:53.420732Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T18:43:30.904Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://hackerone.com/reports/3599470"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Collectives",
          "vendor": "Nextcloud",
          "versions": [
            {
              "lessThanOrEqual": "3.5.0",
              "status": "affected",
              "version": "3.2.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "_dha (yoyomiski)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 2.4,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-840",
              "description": "CWE-840 Business Logic Errors",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T15:25:33.269Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/3599470"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-77166",
    "datePublished": "2026-09-21T15:25:33.269Z",
    "dateReserved": "2026-08-20T15:00:00.606Z",
    "dateUpdated": "2026-09-21T18:43:30.904Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-77165 (GCVE-0-2026-77165)

Vulnerability from nvd – Published: 2026-09-21 15:25 – Updated: 2026-09-21 18:44

Summary

File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database.

Severity

6.5 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-21 18:44 UTC

CWE

CWE-284 - Improper Access Control - Generic

Assigner

hackerone CNA under the mitre root

CNA scorecard D 60/100 over 214 records in the last 180 days details

References

1 reference

URL	Tags
https://hackerone.com/reports/3770482

Impacted products

1 product

Vendor	Product	Version
Nextcloud	Server	Affected: 32.0.0 , ≤ 34.0.0 (semver)

Credits

rz1027 (rz1027)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77165",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T18:44:04.025208Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T18:44:22.324Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://hackerone.com/reports/3770482"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Server",
          "vendor": "Nextcloud",
          "versions": [
            {
              "lessThanOrEqual": "34.0.0",
              "status": "affected",
              "version": "32.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "rz1027 (rz1027)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control - Generic",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T15:25:33.553Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/3770482"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-77165",
    "datePublished": "2026-09-21T15:25:33.553Z",
    "dateReserved": "2026-08-20T15:00:00.606Z",
    "dateUpdated": "2026-09-21T18:44:22.324Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-82985 (GCVE-0-2026-82985)

Vulnerability from nvd – Published: 2026-09-18 01:26 – Updated: 2026-09-18 19:40

Summary

The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewing the album, rather than the album owner's configuration. When an album owner shares a smart album with another user, that user's own folder configuration is used to determine which of the owner's files are searched — allowing them to discover files (name, file ID, and other metadata) in folders the album owner never intended to include in the shared album. This requires the album owner to have shared a filter-based smart album with the attacker; it does not allow access to arbitrary users' files without such a share.

Severity

6.5 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-18 19:40 UTC

CWE

CWE-284 - Improper Access Control - Generic

Assigner

hackerone CNA under the mitre root

CNA scorecard D 60/100 over 214 records in the last 180 days details

References

1 reference

URL	Tags
https://hackerone.com/reports/3506873

Impacted products

1 product

Vendor	Product	Version
Nextcloud	Server	Affected: 32.0.0 , < 32.0.0 (semver)

Credits

Joseph Semaan (suul)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-82985",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-18T19:40:32.206813Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-18T19:40:43.484Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Server",
          "vendor": "Nextcloud",
          "versions": [
            {
              "lessThan": "32.0.0",
              "status": "affected",
              "version": "32.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Joseph Semaan (suul)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Photos app\u0027s filter-based \"smart albums\" build their file listing using the search configuration (photosSourceFolders) of the user viewing the album, rather than the album owner\u0027s configuration. When an album owner shares a smart album with another user, that user\u0027s own folder configuration is used to determine which of the owner\u0027s files are searched \u2014 allowing them to discover files (name, file ID, and other metadata) in folders the album owner never intended to include in the shared album.\n\nThis requires the album owner to have shared a filter-based smart album with the attacker; it does not allow access to arbitrary users\u0027 files without such a share."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control - Generic",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T01:26:04.650Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/3506873"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-82985",
    "datePublished": "2026-09-18T01:26:04.650Z",
    "dateReserved": "2026-08-31T15:00:00.544Z",
    "dateUpdated": "2026-09-18T19:40:43.484Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-82982 (GCVE-0-2026-82982)

Vulnerability from nvd – Published: 2026-09-18 01:26 – Updated: 2026-09-18 19:42

Summary

The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after they reviewed it. The backend only enforced this check when the etag parameter was present and non-empty in the request. An attacker able to intercept and modify the approval request could omit the etag field entirely, bypassing the freshness check and approving or rejecting a file version they never reviewed.

Severity

4.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-18 19:41 UTC

CWE

CWE-840 - Business Logic Errors

Assigner

hackerone CNA under the mitre root

CNA scorecard D 60/100 over 214 records in the last 180 days details

References

1 reference

URL	Tags
https://hackerone.com/reports/3610332

Impacted products

1 product

Vendor	Product	Version
Nextcloud	Approval	Affected: 1.0.0 , ≤ 3.0.0 (semver)

Credits

Dang Hung Vi (vidang04)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-82982",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-18T19:41:50.479115Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-18T19:42:03.054Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Approval",
          "vendor": "Nextcloud",
          "versions": [
            {
              "lessThanOrEqual": "3.0.0",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Dang Hung Vi (vidang04)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Approval app\u0027s approve/reject endpoint is meant to require the file\u0027s current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after they reviewed it. The backend only enforced this check when the etag parameter was present and non-empty in the request. An attacker able to intercept and modify the approval request could omit the etag field entirely, bypassing the freshness check and approving or rejecting a file version they never reviewed."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-840",
              "description": "CWE-840 Business Logic Errors",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T01:26:04.619Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/3610332"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-82982",
    "datePublished": "2026-09-18T01:26:04.619Z",
    "dateReserved": "2026-08-31T15:00:00.543Z",
    "dateUpdated": "2026-09-18T19:42:03.054Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-82980 (GCVE-0-2026-82980)

Vulnerability from nvd – Published: 2026-09-18 01:26 – Updated: 2026-09-18 19:42

Summary

Any authenticated user can lock or unlock files they do not own by targeting absolute WebDAV paths of other users. The DAV plugin resolves files from the absolute request URI without verifying that the path segment matches the authenticated session user. This enables: Cross-user manual locks : attacker locks a victim's files, blocking writes (PUT/MOVE/DELETE, editor saves). Lock-token disclosure: the app returns the lock token to unauthorized callers, enabling them to remove token-based locks (client locks) of other users.

Severity

6.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-18 19:42 UTC

CWE

CWE-287 - Improper Authentication - Generic

Assigner

hackerone CNA under the mitre root

CNA scorecard D 60/100 over 214 records in the last 180 days details

References

1 reference

URL	Tags
https://hackerone.com/reports/3301553

Impacted products

1 product

Vendor	Product	Version
Nextcloud	Files Lock	Affected: 31.0.0 , ≤ 33.0.0 (semver)

Credits

Balvant Chavda (0x0doteth)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-82980",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-18T19:42:46.238881Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-18T19:42:58.732Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Files Lock",
          "vendor": "Nextcloud",
          "versions": [
            {
              "lessThanOrEqual": "33.0.0",
              "status": "affected",
              "version": "31.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Balvant Chavda (0x0doteth)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Any authenticated user can lock or unlock files they do not own by targeting absolute WebDAV paths of other users. The DAV plugin resolves files from the absolute request URI without verifying that the path segment matches the authenticated session user. This enables:\n\nCross-user manual locks : attacker locks a victim\u0027s files, blocking writes (PUT/MOVE/DELETE, editor saves).\nLock-token disclosure: the app returns the lock token to unauthorized callers, enabling them to remove token-based locks (client locks) of other users."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287 Improper Authentication - Generic",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T01:26:04.588Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/3301553"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-82980",
    "datePublished": "2026-09-18T01:26:04.588Z",
    "dateReserved": "2026-08-31T15:00:00.543Z",
    "dateUpdated": "2026-09-18T19:42:58.732Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-77170 (GCVE-0-2026-77170)

Vulnerability from nvd – Published: 2026-09-18 01:26 – Updated: 2026-09-18 19:41

Summary

The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has permission to manage the referenced board.

Severity

4.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-18 19:41 UTC

CWE

CWE-284 - Improper Access Control - Generic

Assigner

hackerone CNA under the mitre root

CNA scorecard D 60/100 over 214 records in the last 180 days details

References

1 reference

URL	Tags
https://hackerone.com/reports/3599383

Impacted products

1 product

Vendor	Product	Version
Nextcloud	Deck	Affected: 1.16.0 , ≤ 1.18.0 (semver)

Credits

Dang Hung Vi (vidang04)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77170",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-18T19:41:21.226672Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-18T19:41:31.474Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Deck",
          "vendor": "Nextcloud",
          "versions": [
            {
              "lessThanOrEqual": "1.18.0",
              "status": "affected",
              "version": "1.16.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Dang Hung Vi (vidang04)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has permission to manage the referenced board."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control - Generic",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T01:26:04.640Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/3599383"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-77170",
    "datePublished": "2026-09-18T01:26:04.640Z",
    "dateReserved": "2026-08-20T15:00:00.606Z",
    "dateUpdated": "2026-09-18T19:41:31.474Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-77169 (GCVE-0-2026-77169)

Vulnerability from nvd – Published: 2026-09-18 01:26 – Updated: 2026-09-18 19:42

Summary

A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed API/REST-only delegated administrators to bypass folder-level authorization controls. The workspace app enables organizations to delegate limited administrative privileges for team folder management via API/REST only, restricting access to folders for which the admin has advanced permissions.

Severity

6.5 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-18 19:42 UTC

CWE

CWE-284 - Improper Access Control - Generic

Assigner

hackerone CNA under the mitre root

CNA scorecard D 60/100 over 214 records in the last 180 days details

References

1 reference

URL	Tags
https://hackerone.com/reports/3674940

Impacted products

1 product

Vendor	Product	Version
Nextcloud	Team Folders	Affected: 13.0.0 , < 22.0.0 (semver)

Credits

qloo (qloo)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77169",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-18T19:42:21.795020Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-18T19:42:32.751Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Team Folders",
          "vendor": "Nextcloud",
          "versions": [
            {
              "lessThan": "22.0.0",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "qloo (qloo)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed API/REST-only delegated administrators to bypass folder-level authorization controls. The workspace app enables organizations to delegate limited administrative privileges for team folder management via API/REST only, restricting access to folders for which the admin has advanced permissions."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control - Generic",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T01:26:04.614Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/3674940"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-77169",
    "datePublished": "2026-09-18T01:26:04.614Z",
    "dateReserved": "2026-08-20T15:00:00.606Z",
    "dateUpdated": "2026-09-18T19:42:32.751Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-77164 (GCVE-0-2026-77164)

Vulnerability from nvd – Published: 2026-09-18 01:26 – Updated: 2026-09-18 19:41

Summary

Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF protections. The public, unauthenticated endpoints POST /apps/circles/event/ and POST /apps/circles/incoming/ reach this code path, allowing any unauthenticated user to force the server to issue a GET request to an internal address. The response body of the internal request is never returned to the requester, so this is blind SSRF: an attacker can determine whether an internal service is reachable, but cannot read its response contents through this endpoint alone.

Severity

6.2 (Medium)


                        
                          CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-18 19:40 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

hackerone CNA under the mitre root

CNA scorecard D 60/100 over 214 records in the last 180 days details

References

1 reference

URL	Tags
https://hackerone.com/reports/3303283

Impacted products

1 product

Vendor	Product	Version
Nextcloud	Server	Affected: 31.0.0 , ≤ 32.0.0 (semver)

Credits

Balvant Chavda (0x0doteth)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77164",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-18T19:40:57.953385Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-18T19:41:07.400Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Server",
          "vendor": "Nextcloud",
          "versions": [
            {
              "lessThanOrEqual": "32.0.0",
              "status": "affected",
              "version": "31.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Balvant Chavda (0x0doteth)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Circles\u0027 remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud\u0027s core SSRF protections. The public, unauthenticated endpoints POST /apps/circles/event/ and POST /apps/circles/incoming/ reach this code path, allowing any unauthenticated user to force the server to issue a GET request to an internal address.\n\nThe response body of the internal request is never returned to the requester, so this is blind SSRF: an attacker can determine whether an internal service is reachable, but cannot read its response contents through this endpoint alone."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T01:26:04.650Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/3303283"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-77164",
    "datePublished": "2026-09-18T01:26:04.650Z",
    "dateReserved": "2026-08-20T15:00:00.606Z",
    "dateUpdated": "2026-09-18T19:41:07.400Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-82984 (GCVE-0-2026-82984)

Vulnerability from cvelistv5 – Published: 2026-10-27 16:15 – Updated: 2026-11-04 20:25

Summary

When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be called directly, allowing any authenticated non-member to enumerate the team's internal resources and their identifiers. This does not grant access to the contents of the discovered resources themselves, only their existence, names, and identifiers.

Severity

4.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 19:32 UTC

CWE

CWE-284 - Improper Access Control - Generic

Assigner

hackerone CNA under the mitre root

CNA scorecard D 60/100 over 214 records in the last 180 days details

References

1 reference

URL	Tags
https://hackerone.com/reports/3511955

Impacted products

1 product

Vendor	Product	Version
Nextcloud	Server	Affected: 32.0.0 , ≤ 33.0.0 (semver)

Credits

_dha (yoyomiski)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-82984",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T19:32:09.273078Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T20:25:03.302Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Server",
          "vendor": "Nextcloud",
          "versions": [
            {
              "lessThanOrEqual": "33.0.0",
              "status": "affected",
              "version": "32.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "_dha (yoyomiski)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When a team was configured as \"visible to everyone\", the web UI correctly blocked non-members from viewing the team (\"You are not a member of ...\"), but the resources API endpoint could still be called directly, allowing any authenticated non-member to enumerate the team\u0027s internal resources and their identifiers.\n\nThis does not grant access to the contents of the discovered resources themselves, only their existence, names, and identifiers."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control - Generic",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T16:15:34.831Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/3511955"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-82984",
    "datePublished": "2026-10-27T16:15:34.831Z",
    "dateReserved": "2026-08-31T15:00:00.544Z",
    "dateUpdated": "2026-11-04T20:25:03.302Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-77167 (GCVE-0-2026-77167)

Vulnerability from cvelistv5 – Published: 2026-10-27 16:15 – Updated: 2026-11-04 20:25

Summary

Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely — there is no automatic cleanup mechanism. Three distinct denial-of-service conditions follow from this write primitive, all triggered from the same unauthenticated source and all self-renewing on a 24-hour cycle for as long as the injected rows remain in the database.

Severity

7.5 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 20:07 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

hackerone CNA under the mitre root

CNA scorecard D 60/100 over 214 records in the last 180 days details

References

1 reference

URL	Tags
https://hackerone.com/reports/3679640

Impacted products

1 product

Vendor	Product	Version
Nextcloud	server	Affected: 22.0.0 , ≤ 34.0.0 (semver)

Credits

ncsc_nl

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77167",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T20:07:41.893986Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T20:25:10.944Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "server",
          "vendor": "Nextcloud",
          "versions": [
            {
              "lessThanOrEqual": "34.0.0",
              "status": "affected",
              "version": "22.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "ncsc_nl"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely \u2014 there is no automatic cleanup mechanism. Three distinct denial-of-service conditions follow from this write primitive, all triggered from the same unauthenticated source and all self-renewing on a 24-hour cycle for as long as the injected rows remain in the database."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400 Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T16:15:34.778Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/3679640"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-77167",
    "datePublished": "2026-10-27T16:15:34.778Z",
    "dateReserved": "2026-08-20T15:00:00.606Z",
    "dateUpdated": "2026-11-04T20:25:10.944Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-77173 (GCVE-0-2026-77173)

Vulnerability from cvelistv5 – Published: 2026-10-27 16:15 – Updated: 2026-11-04 20:25

Summary

A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as confidential.

Severity

4.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 19:32 UTC

CWE

CWE-284 - Improper Access Control - Generic

Assigner

hackerone CNA under the mitre root

CNA scorecard D 60/100 over 214 records in the last 180 days details

References

1 reference

URL	Tags
https://hackerone.com/reports/3682163

Impacted products

1 product

Vendor	Product	Version
Nextcloud	Files Confidential	Affected: 3.3.0 , ≤ 5.0.0 (semver)

Credits

XavLimSG (xavlimsg)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77173",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T19:32:07.896827Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T20:25:17.386Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Files Confidential",
          "vendor": "Nextcloud",
          "versions": [
            {
              "lessThanOrEqual": "5.0.0",
              "status": "affected",
              "version": "3.3.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "XavLimSG (xavlimsg)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as confidential."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control - Generic",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T16:15:34.777Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/3682163"
        }
      ],
      "workarounds": [
        {
          "lang": "en",
          "value": "Change config setting: Add # to forbidden_filename_characters and rename all affected files"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-77173",
    "datePublished": "2026-10-27T16:15:34.777Z",
    "dateReserved": "2026-08-20T15:00:00.607Z",
    "dateUpdated": "2026-11-04T20:25:17.386Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-67400 (GCVE-0-2026-67400)

Vulnerability from cvelistv5 – Published: 2026-10-27 16:15 – Updated: 2026-11-04 20:25

Summary

A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token.

Severity

3.5 (Low)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 19:32 UTC

CWE

CWE-284 - Improper Access Control - Generic

Assigner

hackerone CNA under the mitre root

CNA scorecard D 60/100 over 214 records in the last 180 days details

References

1 reference

URL	Tags
https://hackerone.com/reports/3568116

Impacted products

1 product

Vendor	Product	Version
Nextcloud	Richdocuments	Affected: 11.0.0 , ≤ 11.0.0 (semver)

Credits

Ibrahim el zein (bornwinnerrr)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-67400",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T19:32:06.273605Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T20:25:23.074Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Richdocuments",
          "vendor": "Nextcloud",
          "versions": [
            {
              "lessThanOrEqual": "11.0.0",
              "status": "affected",
              "version": "11.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ibrahim el zein  (bornwinnerrr)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control - Generic",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T16:15:34.773Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/3568116"
        }
      ],
      "workarounds": [
        {
          "lang": "en",
          "value": "Disable app richdocuments"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-67400",
    "datePublished": "2026-10-27T16:15:34.773Z",
    "dateReserved": "2026-07-29T15:00:02.294Z",
    "dateUpdated": "2026-11-04T20:25:23.074Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-77171 (GCVE-0-2026-77171)

Vulnerability from cvelistv5 – Published: 2026-10-27 16:15 – Updated: 2026-11-04 20:25

Summary

A public shared collective always allowed recipients of the link to create pages.

Severity

3.5 (Low)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 19:32 UTC

CWE

CWE-284 - Improper Access Control - Generic

Assigner

hackerone CNA under the mitre root

CNA scorecard D 60/100 over 214 records in the last 180 days details

References

1 reference

URL	Tags
https://hackerone.com/reports/3533697

Impacted products

1 product

Vendor	Product	Version
Nextcloud	Collectives	Affected: 4.0.0 , ≤ 4.0.0 (semver)

Credits

_dha (yoyomiski)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77171",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T19:32:04.896377Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T20:25:28.802Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Collectives",
          "vendor": "Nextcloud",
          "versions": [
            {
              "lessThanOrEqual": "4.0.0",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "_dha (yoyomiski)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A public shared collective always allowed recipients of the link to create pages."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control - Generic",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T16:15:34.770Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/3533697"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-77171",
    "datePublished": "2026-10-27T16:15:34.770Z",
    "dateReserved": "2026-08-20T15:00:00.606Z",
    "dateUpdated": "2026-11-04T20:25:28.802Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-77172 (GCVE-0-2026-77172)

Vulnerability from cvelistv5 – Published: 2026-10-27 16:15 – Updated: 2026-11-04 17:58

Summary

App passwords were allowed to bypass password confirmation on sensitive endpoints.

Severity

5.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 17:58 UTC

CWE

CWE-269 - Improper Privilege Management

Assigner

hackerone CNA under the mitre root

CNA scorecard D 60/100 over 214 records in the last 180 days details

References

1 reference

URL	Tags
https://hackerone.com/reports/3566607

Impacted products

1 product

Vendor	Product	Version
Nextcloud	Server	Affected: 32.0.0 , ≤ 34.0.0 (semver)

Credits

Nicholas Carlini (npc)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77172",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T17:58:16.970924Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T17:58:26.808Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Server",
          "vendor": "Nextcloud",
          "versions": [
            {
              "lessThanOrEqual": "34.0.0",
              "status": "affected",
              "version": "32.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nicholas Carlini (npc)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "App passwords were allowed to bypass password confirmation on sensitive endpoints."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T16:15:34.765Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/3566607"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-77172",
    "datePublished": "2026-10-27T16:15:34.765Z",
    "dateReserved": "2026-08-20T15:00:00.607Z",
    "dateUpdated": "2026-11-04T17:58:26.808Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-87897 (GCVE-0-2026-87897)

Vulnerability from cvelistv5 – Published: 2026-10-27 16:15 – Updated: 2026-11-04 17:59

Summary

A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user. A low privileged attacker could continually exploit this vulnerability to leak the JWT authentication token for another user when they start a recording, which then enables the attacker read/write access to the victim's Whiteboard.

Severity

4.6 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 17:58 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

hackerone CNA under the mitre root

CNA scorecard D 60/100 over 214 records in the last 180 days details

References

1 reference

URL	Tags
https://hackerone.com/reports/3576823

Impacted products

1 product

Vendor	Product	Version
Nextcloud	whiteboard	Affected: 1.0.0 , < 1.0.0 (semver)

Credits

alex-elttam (alex-elttam)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-87897",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T17:58:52.045220Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T17:59:02.350Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "whiteboard",
          "vendor": "Nextcloud",
          "versions": [
            {
              "lessThan": "1.0.0",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "alex-elttam (alex-elttam)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user. A low privileged attacker could continually exploit this vulnerability to leak the JWT authentication token for another user when they start a recording, which then enables the attacker read/write access to the victim\u0027s Whiteboard."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918 Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T16:15:34.742Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/3576823"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-87897",
    "datePublished": "2026-10-27T16:15:34.742Z",
    "dateReserved": "2026-09-09T15:00:00.573Z",
    "dateUpdated": "2026-11-04T17:59:02.350Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-82983 (GCVE-0-2026-82983)

Vulnerability from cvelistv5 – Published: 2026-10-27 16:15 – Updated: 2026-11-04 17:53

Summary

The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level permission on the table before returning the full list of share recipients (users, groups, and teams) along with their permission levels. A user who was only granted read-data access to a table, and who is correctly prevented from seeing this information in the web UI, could call the endpoint directly to enumerate everyone the table is shared with and their access levels. This does not expose the table's data itself beyond what the read-data grant already permits, only the list of share recipients and their permission levels.

Severity

3.3 (Low)


                        
                          CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 17:52 UTC

CWE

CWE-200 - Information Disclosure

Assigner

hackerone CNA under the mitre root

CNA scorecard D 60/100 over 214 records in the last 180 days details

References

1 reference

URL	Tags
https://hackerone.com/reports/3524971

Impacted products

1 product

Vendor	Product	Version
Nextcloud	Tables	Affected: 0.8.1 , ≤ 2.0.0 (semver)

Credits

_dha (yoyomiski)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-82983",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T17:52:46.125191Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T17:53:04.349Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Tables",
          "vendor": "Nextcloud",
          "versions": [
            {
              "lessThanOrEqual": "2.0.0",
              "status": "affected",
              "version": "0.8.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "_dha (yoyomiski)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Tables app\u0027s share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level permission on the table before returning the full list of share recipients (users, groups, and teams) along with their permission levels. A user who was only granted read-data access to a table, and who is correctly prevented from seeing this information in the web UI, could call the endpoint directly to enumerate everyone the table is shared with and their access levels.\n\nThis does not expose the table\u0027s data itself beyond what the read-data grant already permits, only the list of share recipients and their permission levels."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Information Disclosure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T16:15:34.683Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/3524971"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-82983",
    "datePublished": "2026-10-27T16:15:34.683Z",
    "dateReserved": "2026-08-31T15:00:00.543Z",
    "dateUpdated": "2026-11-04T17:53:04.349Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-82986 (GCVE-0-2026-82986)

Vulnerability from cvelistv5 – Published: 2026-10-27 16:15 – Updated: 2026-11-04 17:47

Summary

The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission.

Severity

4.6 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 17:47 UTC

CWE

CWE-284 - Improper Access Control - Generic

Assigner

hackerone CNA under the mitre root

CNA scorecard D 60/100 over 214 records in the last 180 days details

References

1 reference

URL	Tags
https://hackerone.com/reports/3642236

Impacted products

1 product

Vendor	Product	Version
Nextcloud	Tables	Affected: 0.6.4 , ≤ 1.0.0 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-82986",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T17:47:39.070313Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T17:47:48.887Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Tables",
          "vendor": "Nextcloud",
          "versions": [
            {
              "lessThanOrEqual": "1.0.0",
              "status": "affected",
              "version": "0.6.4",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn\u0027t have that permission."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control - Generic",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T16:15:34.671Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/3642236"
        }
      ],
      "workarounds": [
        {
          "lang": "en",
          "value": "The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn\u0027t have that permission."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-82986",
    "datePublished": "2026-10-27T16:15:34.671Z",
    "dateReserved": "2026-08-31T15:00:00.544Z",
    "dateUpdated": "2026-11-04T17:47:48.887Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-77165 (GCVE-0-2026-77165)

Vulnerability from cvelistv5 – Published: 2026-09-21 15:25 – Updated: 2026-09-21 18:44

Summary

File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database.

Severity

6.5 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-21 18:44 UTC

CWE

CWE-284 - Improper Access Control - Generic

Assigner

hackerone CNA under the mitre root

CNA scorecard D 60/100 over 214 records in the last 180 days details

References

1 reference

URL	Tags
https://hackerone.com/reports/3770482

Impacted products

1 product

Vendor	Product	Version
Nextcloud	Server	Affected: 32.0.0 , ≤ 34.0.0 (semver)

Credits

rz1027 (rz1027)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77165",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T18:44:04.025208Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T18:44:22.324Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://hackerone.com/reports/3770482"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Server",
          "vendor": "Nextcloud",
          "versions": [
            {
              "lessThanOrEqual": "34.0.0",
              "status": "affected",
              "version": "32.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "rz1027 (rz1027)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control - Generic",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T15:25:33.553Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/3770482"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-77165",
    "datePublished": "2026-09-21T15:25:33.553Z",
    "dateReserved": "2026-08-20T15:00:00.606Z",
    "dateUpdated": "2026-09-21T18:44:22.324Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-77166 (GCVE-0-2026-77166)

Vulnerability from cvelistv5 – Published: 2026-09-21 15:25 – Updated: 2026-09-21 18:43

Summary

The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items.

Severity

2.4 (Low)


                        
                          CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-21 18:42 UTC

CWE

CWE-840 - Business Logic Errors

Assigner

hackerone CNA under the mitre root

CNA scorecard D 60/100 over 214 records in the last 180 days details

References

1 reference

URL	Tags
https://hackerone.com/reports/3599470

Impacted products

1 product

Vendor	Product	Version
Nextcloud	Collectives	Affected: 3.2.1 , ≤ 3.5.0 (semver)

Credits

_dha (yoyomiski)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77166",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T18:42:53.420732Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T18:43:30.904Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://hackerone.com/reports/3599470"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Collectives",
          "vendor": "Nextcloud",
          "versions": [
            {
              "lessThanOrEqual": "3.5.0",
              "status": "affected",
              "version": "3.2.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "_dha (yoyomiski)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 2.4,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-840",
              "description": "CWE-840 Business Logic Errors",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T15:25:33.269Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/3599470"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-77166",
    "datePublished": "2026-09-21T15:25:33.269Z",
    "dateReserved": "2026-08-20T15:00:00.606Z",
    "dateUpdated": "2026-09-21T18:43:30.904Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CERTFR-2026-AVI-1392

Vulnerability from certfr_avis - Published: 2026-10-27 - Updated: 2026-10-27

De multiples vulnérabilités ont été découvertes dans les produits Nextcloud. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Nextcloud	Server	Server versions 28.0.x antérieures à 28.0.15 pour nextcloud
Nextcloud	Server	Server versions 29.0.x antérieures à 29.0.16.19 pour nextcloud entreprise
Nextcloud	Server	Server versions 24.0.x antérieures à 24.0.13 pour nextcloud
Nextcloud	Server	Server versions 34.0.x antérieures à 34.0.2 pour nextcloud entreprise
Nextcloud	Server	Server versions 32.0.x antérieures à 32.0.13 pour nextcloud
Nextcloud	Server	Server versions 29.0.x antérieures à 29.0.17 pour nextcloud
Nextcloud	Server	Server versions 33.0.x antérieures à 33.0.7 pour nextcloud enterprise
Nextcloud	Files Confidential	Files Confidential versions postérieures à 4.0.0 et antérieures à 4.1.1 pour nextcloud
Nextcloud	Server	Server versions 24.0.x antérieures à 24.0.12.37 pour nextcloud entreprise
Nextcloud	Server	Server versions 34.0.x antérieures à 34.0.2 pour nextcloud
Nextcloud	Server	Server versions 26.0.x antérieures à 26.0.13.29 pour nextcloud entreprise
Nextcloud	Richdocuments	Richdocuments versions 11.0.x antérieures à 11.0.1 pour nextcloud
Nextcloud	Server	Server versions 27.x antérieures à 27.1.12 pour nextcloud
Nextcloud	Server	Server versions 27.x antérieures à 27.1.11.29 pour nextcloud entreprise
Nextcloud	Richdocuments	Richdocuments versions postérieures à 10.0.0 et antérieures à 10.2.1 pour nextcloud
Nextcloud	Server	Server versions 32.0.x antérieures à 32.0.13 pour nextcloud entreprise
Nextcloud	Server	Server versions 33.0.x antérieures à 33.0.7 pour nextcloud
Nextcloud	Server	Server versions 31.0.x antérieures à 31.0.14.8 pour nextcloud entreprise
Nextcloud	Files Confidential	Files Confidential versions postérieures à 5.0.0 et antérieures à 5.1.0 pour nextcloud
Nextcloud	Richdocuments	Richdocuments versions postérieures à 9.0.0 et antérieures à 9.1.1 pour nextcloud
Nextcloud	Server	Server versions 22.x antérieures à 22.2.11 pour nextcloud
Nextcloud	Server	Server versions 23.0.x antérieures à 23.0.12.38 pour nextcloud entreprise
Nextcloud	Server	Server versions 23.0.x antérieures à 23.0.13 pour nextcloud
Nextcloud	Server	Server versions 25.0.x antérieures à 25.0.13.32 pour nextcloud entreprise
Nextcloud	Server	Server versions 30.0.x antérieures à 30.0.17.12 pour nextcloud entreprise
Nextcloud	Server	Server versions 26.0.x antérieures à 26.0.14 pour nextcloud
Nextcloud	Server	Server versions 22.x antérieures à 22.2.10.42 pour nextcloud entreprise
Nextcloud	Server	Server versions 30.0.x antérieures à 30.0.18 pour nextcloud
Nextcloud	Collectives	Collectives versions postérieures à 4.0.0 et antérieures à 4.4.0 pour nextcloud
Nextcloud	Server	Server versions 25.0.x antérieures à 25.0.14 pour nextcloud
Nextcloud	Files Confidential	Files Confidential versions 3.3.x antérieures à 3.3.1 pour nextcloud
Nextcloud	Server	Server versions 31.0.x antérieures à 31.0.15 pour nextcloud
Nextcloud	Server	Server versions 28.0.x antérieures à 28.0.14.20 pour nextcloud entreprise

References

Title

Publication Time

CERTFR-2026-AVI-1283

Vulnerability from certfr_avis - Published: 2026-10-09 - Updated: 2026-10-09

De multiples vulnérabilités ont été découvertes dans les produits Nextcloud. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, un déni de service à distance et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Nextcloud	N/A	Team Folders versions 21.x antérieures à 21.0.8
Nextcloud	Server	Server versions 33.0.x antérieures à 33.0.6
Nextcloud	Server	Server versions 34.0.x antérieures à 34.0.1
Nextcloud	N/A	Team Folders versions 20.x et antérieures à 20.1.15
Nextcloud	N/A	Collectives versions antérieures à 4.4.1
Nextcloud	N/A	Team Folders versions 14.x antérieures à 14.0.12
Nextcloud	N/A	Team Folders versions 15.x et antérieures à 15.3.13
Nextcloud	N/A	Team Folders versions antérieures à 13.1.8
Nextcloud	N/A	Team Folders versions 18.x et antérieures à 18.1.14
Nextcloud	N/A	Team Folders versions 16.x antérieures à 16.0.16
Nextcloud	N/A	Team Folders versions 19.x antérieures à 19.1.19
Nextcloud	N/A	Team Folders versions 17.x antérieures à 17.0.16
Nextcloud	N/A	Team Folders versions 22.x antérieures à 22.0.1
Nextcloud	Server	Server versions 32.0.x antérieures à 32.0.12 pour nextcloud
Nextcloud	N/A	files_lock versions 33.0.x antérieures à 33.0.6

References

Title

Publication Time

Find a vulnerability

Search criteria

814 vulnerabilities by NextCloud

CVE-2026-87897 (GCVE-0-2026-87897)

CVE-2026-82986 (GCVE-0-2026-82986)

CVE-2026-82984 (GCVE-0-2026-82984)

CVE-2026-82983 (GCVE-0-2026-82983)

CVE-2026-77173 (GCVE-0-2026-77173)

CVE-2026-77172 (GCVE-0-2026-77172)

CVE-2026-77171 (GCVE-0-2026-77171)

CVE-2026-77167 (GCVE-0-2026-77167)

CVE-2026-67400 (GCVE-0-2026-67400)

CVE-2026-77166 (GCVE-0-2026-77166)

CVE-2026-77165 (GCVE-0-2026-77165)

CVE-2026-82985 (GCVE-0-2026-82985)

CVE-2026-82982 (GCVE-0-2026-82982)

CVE-2026-82980 (GCVE-0-2026-82980)

CVE-2026-77170 (GCVE-0-2026-77170)

CVE-2026-77169 (GCVE-0-2026-77169)

CVE-2026-77164 (GCVE-0-2026-77164)

CVE-2026-82984 (GCVE-0-2026-82984)

CVE-2026-77167 (GCVE-0-2026-77167)

CVE-2026-77173 (GCVE-0-2026-77173)

CVE-2026-67400 (GCVE-0-2026-67400)

CVE-2026-77171 (GCVE-0-2026-77171)

CVE-2026-77172 (GCVE-0-2026-77172)

CVE-2026-87897 (GCVE-0-2026-87897)

CVE-2026-82983 (GCVE-0-2026-82983)

CVE-2026-82986 (GCVE-0-2026-82986)

CVE-2026-77165 (GCVE-0-2026-77165)

CVE-2026-77166 (GCVE-0-2026-77166)

CERTFR-2026-AVI-1392

Solutions

CERTFR-2026-AVI-1283

Solutions