Nextcloud 3D Viewer CVE-2026-104189

Exploitation requires: (1) the threedviewer app installed and enabled on the Nextcloud instance at a vulnerable version (1.7.9 through 3.3.1); (2) an existing link share whose password protection the attacker wants to bypass; (3) attacker knowledge of the share token (the token in the shared URL) and the target fileId; and (4) the shared content being one of the app's supported 3D formats (STL, GLB/glTF, OBJ, STEP, IFC and other supported 3D types). Limiting factors confirmed by the advisory: non-3D files in the same share are unaffected, and expired shares return 500 rather than leaking contents, so only live, password-protected shares of 3D-format files are exposed. No password, session, or user interaction is needed once the token is known.

This is a genuine, easy-to-exploit confidentiality flaw but with a narrow blast radius. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H) is internally consistent with the description: a remote, unauthenticated attacker who merely knows a share token can retrieve the full file body from a password-protected link share over the network with no special complexity. The signals align rather than conflict - the advisory confirms the mechanism (CWE-306 missing authorization, compounded by CWE-863), the vendor confirms a fix in 3.3.2, and the vuln.today decision label is 'this_week' (not act_now/emergency). No EPSS score was provided and the input does not list KEV status, so this is treated as not in CISA KEV: no public exploit identified at time of analysis, and no evidence of active exploitation. The practical risk is bounded by two description-confirmed facts: the leak is limited strictly to the 3D file formats the app handles (STL, GLB/glTF, OBJ, STEP, IFC and other supported 3D types), and the attacker must already possess the share token. This is therefore a real priority for sites running the app with password-protected 3D shares, but its real-world risk is lower than the raw 7.5 suggests because it depends on a niche third-party plugin being installed and on 3D-format content being shared with password protection.

An attacker obtains a Nextcloud link-share token that was pasted into a chat, email, or ticket but is supposed to be protected by a share password. Instead of hitting the share page (which correctly redirects to the password prompt), the attacker sends GET /ocs/v2.php/apps/threedviewer/public/file/{token}/{fileId} and receives a 200 with the full 3D model file body, bypassing the password entirely. No public exploit code is identified, but the advisory documents the exact request needed.