Vulnerability-Lookup

CERTFR-2026-AVI-1392

Vulnerability from certfr_avis - Published: 2026-10-27 - Updated: 2026-10-27

De multiples vulnérabilités ont été découvertes dans les produits Nextcloud. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Nextcloud	Server	Server versions 28.0.x antérieures à 28.0.15 pour nextcloud
Nextcloud	Server	Server versions 29.0.x antérieures à 29.0.16.19 pour nextcloud entreprise
Nextcloud	Server	Server versions 24.0.x antérieures à 24.0.13 pour nextcloud
Nextcloud	Server	Server versions 34.0.x antérieures à 34.0.2 pour nextcloud entreprise
Nextcloud	Server	Server versions 32.0.x antérieures à 32.0.13 pour nextcloud
Nextcloud	Server	Server versions 29.0.x antérieures à 29.0.17 pour nextcloud
Nextcloud	Server	Server versions 33.0.x antérieures à 33.0.7 pour nextcloud enterprise
Nextcloud	Files Confidential	Files Confidential versions postérieures à 4.0.0 et antérieures à 4.1.1 pour nextcloud
Nextcloud	Server	Server versions 24.0.x antérieures à 24.0.12.37 pour nextcloud entreprise
Nextcloud	Server	Server versions 34.0.x antérieures à 34.0.2 pour nextcloud
Nextcloud	Server	Server versions 26.0.x antérieures à 26.0.13.29 pour nextcloud entreprise
Nextcloud	Richdocuments	Richdocuments versions 11.0.x antérieures à 11.0.1 pour nextcloud
Nextcloud	Server	Server versions 27.x antérieures à 27.1.12 pour nextcloud
Nextcloud	Server	Server versions 27.x antérieures à 27.1.11.29 pour nextcloud entreprise
Nextcloud	Richdocuments	Richdocuments versions postérieures à 10.0.0 et antérieures à 10.2.1 pour nextcloud
Nextcloud	Server	Server versions 32.0.x antérieures à 32.0.13 pour nextcloud entreprise
Nextcloud	Server	Server versions 33.0.x antérieures à 33.0.7 pour nextcloud
Nextcloud	Server	Server versions 31.0.x antérieures à 31.0.14.8 pour nextcloud entreprise
Nextcloud	Files Confidential	Files Confidential versions postérieures à 5.0.0 et antérieures à 5.1.0 pour nextcloud
Nextcloud	Richdocuments	Richdocuments versions postérieures à 9.0.0 et antérieures à 9.1.1 pour nextcloud
Nextcloud	Server	Server versions 22.x antérieures à 22.2.11 pour nextcloud
Nextcloud	Server	Server versions 23.0.x antérieures à 23.0.12.38 pour nextcloud entreprise
Nextcloud	Server	Server versions 23.0.x antérieures à 23.0.13 pour nextcloud
Nextcloud	Server	Server versions 25.0.x antérieures à 25.0.13.32 pour nextcloud entreprise
Nextcloud	Server	Server versions 30.0.x antérieures à 30.0.17.12 pour nextcloud entreprise
Nextcloud	Server	Server versions 26.0.x antérieures à 26.0.14 pour nextcloud
Nextcloud	Server	Server versions 22.x antérieures à 22.2.10.42 pour nextcloud entreprise
Nextcloud	Server	Server versions 30.0.x antérieures à 30.0.18 pour nextcloud
Nextcloud	Collectives	Collectives versions postérieures à 4.0.0 et antérieures à 4.4.0 pour nextcloud
Nextcloud	Server	Server versions 25.0.x antérieures à 25.0.14 pour nextcloud
Nextcloud	Files Confidential	Files Confidential versions 3.3.x antérieures à 3.3.1 pour nextcloud
Nextcloud	Server	Server versions 31.0.x antérieures à 31.0.15 pour nextcloud
Nextcloud	Server	Server versions 28.0.x antérieures à 28.0.14.20 pour nextcloud entreprise

References

Title

Publication Time

Tags

Bulletin de sécurité Nextcloud GHSA-p9qq-6vpv-x7wj	2026-10-27	vendor-advisory
Bulletin de sécurité Nextcloud GHSA-w7pp-8m7c-555c	2026-10-27	vendor-advisory
Bulletin de sécurité Nextcloud GHSA-5572-968j-v7g5	2026-10-27	vendor-advisory
Bulletin de sécurité Nextcloud GHSA-qwm4-h3xh-gmvc	2026-10-27	vendor-advisory
Bulletin de sécurité Nextcloud GHSA-x4hv-m8g6-5cj4	2026-10-27	vendor-advisory
Bulletin de sécurité Nextcloud GHSA-6m4h-j3wr-v388	2026-10-27	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Server versions 28.0.x ant\u00e9rieures \u00e0 28.0.15 pour nextcloud",
      "product": {
        "name": "Server",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Server versions 29.0.x ant\u00e9rieures \u00e0 29.0.16.19 pour nextcloud entreprise",
      "product": {
        "name": "Server",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Server versions 24.0.x ant\u00e9rieures \u00e0 24.0.13 pour nextcloud",
      "product": {
        "name": "Server",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Server versions 34.0.x ant\u00e9rieures \u00e0 34.0.2 pour nextcloud entreprise",
      "product": {
        "name": "Server",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Server versions 32.0.x ant\u00e9rieures \u00e0 32.0.13 pour nextcloud",
      "product": {
        "name": "Server",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Server versions 29.0.x ant\u00e9rieures \u00e0 29.0.17 pour nextcloud",
      "product": {
        "name": "Server",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Server versions 33.0.x ant\u00e9rieures \u00e0 33.0.7 pour nextcloud enterprise",
      "product": {
        "name": "Server",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Files Confidential versions post\u00e9rieures \u00e0 4.0.0 et ant\u00e9rieures \u00e0 4.1.1 pour nextcloud",
      "product": {
        "name": "Files Confidential",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Server versions 24.0.x ant\u00e9rieures \u00e0 24.0.12.37 pour nextcloud entreprise",
      "product": {
        "name": "Server",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Server versions 34.0.x ant\u00e9rieures \u00e0 34.0.2 pour nextcloud",
      "product": {
        "name": "Server",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Server versions 26.0.x ant\u00e9rieures \u00e0 26.0.13.29 pour nextcloud entreprise",
      "product": {
        "name": "Server",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Richdocuments versions 11.0.x ant\u00e9rieures \u00e0 11.0.1 pour nextcloud",
      "product": {
        "name": "Richdocuments",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Server versions 27.x ant\u00e9rieures \u00e0 27.1.12 pour nextcloud",
      "product": {
        "name": "Server",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Server versions 27.x ant\u00e9rieures \u00e0 27.1.11.29 pour nextcloud entreprise",
      "product": {
        "name": "Server",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Richdocuments versions post\u00e9rieures \u00e0 10.0.0 et ant\u00e9rieures \u00e0 10.2.1 pour nextcloud",
      "product": {
        "name": "Richdocuments",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Server versions 32.0.x ant\u00e9rieures \u00e0 32.0.13 pour nextcloud entreprise",
      "product": {
        "name": "Server",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Server versions 33.0.x ant\u00e9rieures \u00e0 33.0.7 pour nextcloud",
      "product": {
        "name": "Server",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Server versions 31.0.x ant\u00e9rieures \u00e0 31.0.14.8 pour nextcloud entreprise",
      "product": {
        "name": "Server",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Files Confidential versions post\u00e9rieures \u00e0 5.0.0 et ant\u00e9rieures \u00e0 5.1.0 pour nextcloud",
      "product": {
        "name": "Files Confidential",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Richdocuments versions post\u00e9rieures \u00e0 9.0.0 et ant\u00e9rieures \u00e0 9.1.1 pour nextcloud",
      "product": {
        "name": "Richdocuments",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Server versions 22.x ant\u00e9rieures \u00e0 22.2.11 pour nextcloud",
      "product": {
        "name": "Server",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Server versions 23.0.x ant\u00e9rieures \u00e0 23.0.12.38 pour nextcloud entreprise",
      "product": {
        "name": "Server",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Server versions 23.0.x ant\u00e9rieures \u00e0 23.0.13 pour nextcloud",
      "product": {
        "name": "Server",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Server versions 25.0.x ant\u00e9rieures \u00e0 25.0.13.32 pour nextcloud entreprise",
      "product": {
        "name": "Server",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Server versions 30.0.x ant\u00e9rieures \u00e0 30.0.17.12 pour nextcloud entreprise",
      "product": {
        "name": "Server",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Server versions 26.0.x ant\u00e9rieures \u00e0 26.0.14 pour nextcloud",
      "product": {
        "name": "Server",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Server versions 22.x ant\u00e9rieures \u00e0 22.2.10.42 pour nextcloud entreprise",
      "product": {
        "name": "Server",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Server versions 30.0.x ant\u00e9rieures \u00e0 30.0.18 pour nextcloud",
      "product": {
        "name": "Server",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Collectives versions post\u00e9rieures \u00e0 4.0.0 et ant\u00e9rieures \u00e0 4.4.0 pour nextcloud",
      "product": {
        "name": "Collectives",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Server versions 25.0.x ant\u00e9rieures \u00e0 25.0.14 pour nextcloud",
      "product": {
        "name": "Server",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Files Confidential versions 3.3.x ant\u00e9rieures \u00e0 3.3.1 pour nextcloud",
      "product": {
        "name": "Files Confidential",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Server versions 31.0.x ant\u00e9rieures \u00e0 31.0.15 pour nextcloud",
      "product": {
        "name": "Server",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    },
    {
      "description": "Server versions 28.0.x ant\u00e9rieures \u00e0 28.0.14.20 pour nextcloud entreprise",
      "product": {
        "name": "Server",
        "vendor": {
          "name": "Nextcloud",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-67400",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67400"
    },
    {
      "name": "CVE-2026-77173",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-77173"
    },
    {
      "name": "CVE-2026-77167",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-77167"
    },
    {
      "name": "CVE-2026-77171",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-77171"
    },
    {
      "name": "CVE-2026-77172",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-77172"
    },
    {
      "name": "CVE-2026-114601",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-114601"
    }
  ],
  "initial_release_date": "2026-10-27T00:00:00",
  "last_revision_date": "2026-10-27T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-1392",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-10-27T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Nextcloud. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Nextcloud",
  "vendor_advisories": [
    {
      "published_at": "2026-10-27",
      "title": "Bulletin de s\u00e9curit\u00e9 Nextcloud GHSA-p9qq-6vpv-x7wj",
      "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-p9qq-6vpv-x7wj"
    },
    {
      "published_at": "2026-10-27",
      "title": "Bulletin de s\u00e9curit\u00e9 Nextcloud GHSA-w7pp-8m7c-555c",
      "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-w7pp-8m7c-555c"
    },
    {
      "published_at": "2026-10-27",
      "title": "Bulletin de s\u00e9curit\u00e9 Nextcloud GHSA-5572-968j-v7g5",
      "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5572-968j-v7g5"
    },
    {
      "published_at": "2026-10-27",
      "title": "Bulletin de s\u00e9curit\u00e9 Nextcloud GHSA-qwm4-h3xh-gmvc",
      "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-qwm4-h3xh-gmvc"
    },
    {
      "published_at": "2026-10-27",
      "title": "Bulletin de s\u00e9curit\u00e9 Nextcloud GHSA-x4hv-m8g6-5cj4",
      "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x4hv-m8g6-5cj4"
    },
    {
      "published_at": "2026-10-27",
      "title": "Bulletin de s\u00e9curit\u00e9 Nextcloud GHSA-6m4h-j3wr-v388",
      "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6m4h-j3wr-v388"
    }
  ]
}

CVE-2026-67400 (GCVE-0-2026-67400)

Vulnerability from cvelistv5 – Published: 2026-10-27 16:15 – Updated: 2026-11-04 20:25

Summary

A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token.

Severity

3.5 (Low)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 19:32 UTC

CWE

CWE-284 - Improper Access Control - Generic

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 213 records in the last 180 days details

References

1 reference

URL	Tags
https://hackerone.com/reports/3568116

Impacted products

1 product

Vendor	Product	Version
Nextcloud	Richdocuments	Affected: 11.0.0 , ≤ 11.0.0 (semver)

Credits

Ibrahim el zein (bornwinnerrr)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-67400",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T19:32:06.273605Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T20:25:23.074Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Richdocuments",
          "vendor": "Nextcloud",
          "versions": [
            {
              "lessThanOrEqual": "11.0.0",
              "status": "affected",
              "version": "11.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ibrahim el zein  (bornwinnerrr)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control - Generic",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T16:15:34.773Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/3568116"
        }
      ],
      "workarounds": [
        {
          "lang": "en",
          "value": "Disable app richdocuments"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-67400",
    "datePublished": "2026-10-27T16:15:34.773Z",
    "dateReserved": "2026-07-29T15:00:02.294Z",
    "dateUpdated": "2026-11-04T20:25:23.074Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-77167 (GCVE-0-2026-77167)

Vulnerability from cvelistv5 – Published: 2026-10-27 16:15 – Updated: 2026-11-04 20:25

Summary

Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely — there is no automatic cleanup mechanism. Three distinct denial-of-service conditions follow from this write primitive, all triggered from the same unauthenticated source and all self-renewing on a 24-hour cycle for as long as the injected rows remain in the database.

Severity

7.5 (High)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 20:07 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 213 records in the last 180 days details

References

1 reference

URL	Tags
https://hackerone.com/reports/3679640

Impacted products

1 product

Vendor	Product	Version
Nextcloud	server	Affected: 22.0.0 , ≤ 34.0.0 (semver)

Credits

ncsc_nl

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77167",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T20:07:41.893986Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T20:25:10.944Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "server",
          "vendor": "Nextcloud",
          "versions": [
            {
              "lessThanOrEqual": "34.0.0",
              "status": "affected",
              "version": "22.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "ncsc_nl"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely \u2014 there is no automatic cleanup mechanism. Three distinct denial-of-service conditions follow from this write primitive, all triggered from the same unauthenticated source and all self-renewing on a 24-hour cycle for as long as the injected rows remain in the database."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400 Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T16:15:34.778Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/3679640"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-77167",
    "datePublished": "2026-10-27T16:15:34.778Z",
    "dateReserved": "2026-08-20T15:00:00.606Z",
    "dateUpdated": "2026-11-04T20:25:10.944Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-77171 (GCVE-0-2026-77171)

Vulnerability from cvelistv5 – Published: 2026-10-27 16:15 – Updated: 2026-11-04 20:25

Summary

A public shared collective always allowed recipients of the link to create pages.

Severity

3.5 (Low)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 19:32 UTC

CWE

CWE-284 - Improper Access Control - Generic

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 213 records in the last 180 days details

References

1 reference

URL	Tags
https://hackerone.com/reports/3533697

Impacted products

1 product

Vendor	Product	Version
Nextcloud	Collectives	Affected: 4.0.0 , ≤ 4.0.0 (semver)

Credits

_dha (yoyomiski)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77171",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T19:32:04.896377Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T20:25:28.802Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Collectives",
          "vendor": "Nextcloud",
          "versions": [
            {
              "lessThanOrEqual": "4.0.0",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "_dha (yoyomiski)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A public shared collective always allowed recipients of the link to create pages."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 3.5,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control - Generic",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T16:15:34.770Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/3533697"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-77171",
    "datePublished": "2026-10-27T16:15:34.770Z",
    "dateReserved": "2026-08-20T15:00:00.606Z",
    "dateUpdated": "2026-11-04T20:25:28.802Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-77172 (GCVE-0-2026-77172)

Vulnerability from cvelistv5 – Published: 2026-10-27 16:15 – Updated: 2026-11-04 17:58

Summary

App passwords were allowed to bypass password confirmation on sensitive endpoints.

Severity

5.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 17:58 UTC

CWE

CWE-269 - Improper Privilege Management

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 213 records in the last 180 days details

References

1 reference

URL	Tags
https://hackerone.com/reports/3566607

Impacted products

1 product

Vendor	Product	Version
Nextcloud	Server	Affected: 32.0.0 , ≤ 34.0.0 (semver)

Credits

Nicholas Carlini (npc)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77172",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T17:58:16.970924Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T17:58:26.808Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Server",
          "vendor": "Nextcloud",
          "versions": [
            {
              "lessThanOrEqual": "34.0.0",
              "status": "affected",
              "version": "32.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Nicholas Carlini (npc)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "App passwords were allowed to bypass password confirmation on sensitive endpoints."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T16:15:34.765Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/3566607"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-77172",
    "datePublished": "2026-10-27T16:15:34.765Z",
    "dateReserved": "2026-08-20T15:00:00.607Z",
    "dateUpdated": "2026-11-04T17:58:26.808Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-77173 (GCVE-0-2026-77173)

Vulnerability from cvelistv5 – Published: 2026-10-27 16:15 – Updated: 2026-11-04 20:25

Summary

A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as confidential.

Severity

4.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 19:32 UTC

CWE

CWE-284 - Improper Access Control - Generic

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 213 records in the last 180 days details

References

1 reference

URL	Tags
https://hackerone.com/reports/3682163

Impacted products

1 product

Vendor	Product	Version
Nextcloud	Files Confidential	Affected: 3.3.0 , ≤ 5.0.0 (semver)

Credits

XavLimSG (xavlimsg)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77173",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T19:32:07.896827Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T20:25:17.386Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Files Confidential",
          "vendor": "Nextcloud",
          "versions": [
            {
              "lessThanOrEqual": "5.0.0",
              "status": "affected",
              "version": "3.3.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "XavLimSG (xavlimsg)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not be marked as confidential."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control - Generic",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T16:15:34.777Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/3682163"
        }
      ],
      "workarounds": [
        {
          "lang": "en",
          "value": "Change config setting: Add # to forbidden_filename_characters and rename all affected files"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-77173",
    "datePublished": "2026-10-27T16:15:34.777Z",
    "dateReserved": "2026-08-20T15:00:00.607Z",
    "dateUpdated": "2026-11-04T20:25:17.386Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CERTFR-2026-AVI-1392

Solutions

CVE-2026-67400 (GCVE-0-2026-67400)

CVE-2026-77167 (GCVE-0-2026-77167)

CVE-2026-77171 (GCVE-0-2026-77171)

CVE-2026-77172 (GCVE-0-2026-77172)

CVE-2026-77173 (GCVE-0-2026-77173)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour