Nextcloud Circles CVE-2026-77164

Exploitable when the Circles (Teams) app is installed and enabled on Nextcloud Server 31.0.0 through 32.0.0, which exposes the public unauthenticated endpoints POST /apps/circles/event/ and POST /apps/circles/incoming/. No authentication, credentials, or user interaction are required - the attacker only needs network access to these HTTP endpoints and supplies a keyId URL targeting an internal/private address. Limiting factors: the SSRF is blind (response body is never returned, so it yields only internal-service reachability, not content), and it requires the Circles app to be active; the vendor's AV:L rating suggests a possible additional local/deployment constraint, though the description indicates full remote reachability.

This is a genuine but moderate-severity issue whose real-world risk is best characterized as an internal-network reconnaissance primitive, not a critical breach vector. Positive signals: the attack is unauthenticated (PR:N), requires no user interaction (UI:N), and is reachable via two public HTTP endpoints (POST /apps/circles/event/ and POST /apps/circles/incoming/), so despite the vendor's AV:L rating the endpoints are network-facing and remotely triggerable. Tempering signals: the SSRF is explicitly BLIND - the response body is never returned, so it only functions as a reachability/port-scan oracle for internal services, not a data-exfiltration channel. There is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis (single HackerOne report). Two vendor-vector conflicts must be stated explicitly: (1) CVSS declares AV:L (local) yet the description says 'any unauthenticated user' can reach the code via public endpoints, which implies AV:N (network) - the vector appears to understate reachability; (2) CVSS declares C:H (high confidentiality) yet the description states the response is never returned to the attacker, which contradicts high confidentiality impact and points to C:L. These conflicts mean the vendor 6.2 both under-rates attack vector and over-rates confidentiality; my independent assessment lands near 5.3. Verify the AV and C metrics with Nextcloud.

An unauthenticated attacker sends a crafted POST to /apps/circles/event/ or /apps/circles/incoming/ containing a keyId URL pointing at an internal address (e.g. http://169.254.169.254/ or an internal service host:port). The Circles signature-verification code fetches that URL before establishing remote-instance trust and, because it explicitly permits local/private addresses, bypasses Nextcloud's core SSRF filter; timing/error differences reveal whether the internal service is reachable. No public exploit code is identified, but the endpoints are unauthenticated and the trigger is a single HTTP request.