Nextcloud Nextcloud Server

Dangling remote share attempts in Nextcloud 16 allow a DNS pollution when running long.

Improper preservation of permissions in Nextcloud Server 14.0.3 causes the event details to be leaked when sharing a non-public event.

Rate limiter not working reliable when Memcached is installed in Nextcloud

A missing check in Nextcloud Server 14.0.3 could give recipient the possibility to extend the expiration date of a share they received.

Nextcloud Server before 9.0.55 and 10.0.2 suffers from a creation of folders in read-only folders despite lacking permissions issue. Due to a logical error in the file caching layer an authenticated adversary is able to create empty folders inside a shared folder. Note that this only affects folders and files that the adversary has at least read-only permissions for.

Insufficient Verification of Data Authenticity in Nextcloud Server

Nextcloud Server vulnerable to attacker enabling/disabling birthday calendar for any user

Text does not respect "Allow download" permissions

Nextcloud Server's Attachments folder for Text app is accessible on "Files drop" and "Password protected" shares

Nextcloud Server vulnerable to insecure temporary file creation, race with write access and permission

Nextcloud Server's read-only users can restore old versions

Nextcloud Server's shares are not removed when user is limited to share with in their groups and being removed from one of them

Nextcloud Server admin_audit does not log all actions on files in groupfolders

Nextcloud Server users can modify tags on files that do not belong to them

Nextcloud Server 30.0.0 is vulnerable to an Insecure Direct Object Reference (IDOR) in the /core/preview endpoint. Any authenticated user can access previews of arbitrary files belonging to other users by manipulating the fileId parameter. This allows unauthorized disclosure of sensitive data, such as text files or images, without prior sharing permissions.

Nextcloud Server allows users to copy folder that contain files that are blocked by the files access control

A cryptographic issue in Nextcloud Server 19.0.1 allowed an attacker to downgrade the encryption scheme and break the integrity of encrypted files.

Default settings leak federated cloud ID to lookup server of all users

OAuth2 authorization codes are valid indefinetly in Nextcloud server

A bug causing session fixation in Nextcloud Server prior to 14.0.0, 13.0.3 and 12.0.8 could potentially allow an attacker to obtain access to password protected shares.

Files Drop public link can be added as federated share

Nextcloud Server before 10.0.4 and 11.0.2 are vulnerable to disclosure of calendar and addressbook names to other logged-in users. Note that no actual content of the calendar and addressbook has been disclosed.

Nextcloud Photos' shared albums have no restriction on photo removal

Nextcloud Server's events information leaked with shared calendars on recurrence exceptions

A too small set of random characters being used for encryption in Nextcloud Server 18.0.4 allowed decryption in shorter time than intended.

Audit log is not properly logging unsetting of share expiration date

Federated share accepting/declining is not logged in audit log in Nextcloud Server

Nextcloud Server has no password length limit when creating a user as an administrator

Nextcloud Server admins can change authentication details of user configured external storage