EUVD-2026-83972
GHSA-8gq2-j3j2-95vm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as member with page-edit rights
-
ExploitSubmit oversized emoji with line breaks via update endpoint
-
ExecutionMalformed value stored and rendered in sidebar
-
ImpactSidebar layout breaks and hides other items for viewers
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Business logic errors
|
| Exploitation Conditions | Requires an authenticated user with write/edit permission to a collective page (per PR:H) who submits crafted input to the page emoji update endpoint of the Nextcloud Collectives app; the emoji field performs no length/newline validation. Impact only manifests when another user (UI:R) views the affected collective and its rendered sidebar. Limiting factors: attacker must already hold page-edit privileges, victim interaction is required, the effect is confined to client-side layout disruption (hiding navigation items) with no confidentiality or availability loss, and it applies only where the optional Collectives app is installed. |
| Impact | This is a genuinely low-risk issue, and the signals agree. The provided CVSS 3.0 vector (AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N) yields a 2.4 base score with only a Low integrity impact and no confidentiality or availability impact - consistent with a cosmetic UI-defacement bug, not a memory-safety or code-execution flaw. No EPSS score, no CISA KEV listing, and no confirmed public exploit code are present in the input, so exploitation status is 'no public exploit identified at time of analysis' (the HackerOne reference is a disclosure report, not a weaponized exploit). The 'Code Injection' tag materially overstates the issue: the description describes broken sidebar layout from unvalidated long text and line breaks in an emoji field, i.e. an input-validation/rendering defect (CWE-840, business-logic/improper-input), NOT arbitrary code execution or XSS (C:N confirms no script-based data theft). The vector requires PR:H and UI:R, both of which further limit real-world impact. Bottom line: low priority - a nuisance/UI-integrity bug in an optional Nextcloud app, mislabeled with a scarier tag than the facts support. |
| Exploit ScenarioDerived | An authenticated user who can edit a collective page calls the page emoji update endpoint and submits an emoji value stuffed with long text and newline characters. The malformed value is stored and rendered in the navigation sidebar, breaking its layout so that other collective items are pushed off-screen or hidden when another member views the page. No public exploit code is identified; the finding originates from a HackerOne report. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 21, 2026
Persistent sidebar layout manipulation in the Nextcloud Collectives app allows an authenticated user with page-edit permission to submit oversized text containing line breaks to the page emoji update endpoint, which accepts the value without length or character validation. When another user subsequently views the affected collective page, the unvalidated emoji string overflows and breaks the rendered sidebar, hiding other navigation items from view. The impact is confined to client-side layout integrity with no confidentiality or availability loss (CVSS 3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N, published vector 2.4 with PR:H), making this a genuinely low-risk issue; no public exploit code has been identified at time of analysis, and it applies only where the optional Collectives app is installed.
RemediationAI
No vendor-released patch identified at time of analysis, so remediation must lean on configuration controls and input hardening. The most direct compensating control is to enforce server-side validation on the page emoji field - cap the accepted value at a small number of bytes and reject or strip CR/LF and other control characters before persistence and before rendering into the sidebar; teams maintaining a fork or deployment can apply this as a minimal patch to the emoji update endpoint, with the trade-off that overly aggressive truncation may reject legitimate multi-codepoint emoji sequences. Operationally, restrict page-edit permission in Collectives to trusted users and groups, since the flaw requires an authenticated account with write access to a collective page and the effect only materializes for second users who view that page, reducing both the attack surface and the blast radius; the trade-off is reduced collaborative flexibility. Where Collectives is not actively used, disabling or removing the app eliminates exposure entirely at the cost of losing the feature. Administrators of exposed instances should track the linked HackerOne report (https://hackerone.com/reports/3599470) and Nextcloud Collectives release notes for an official fix, and should treat the issue as cosmetic/layout disruption rather than a data compromise when prioritizing against higher-severity findings.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Nextcloud Collectives app lets users collaborate on shared 'collective' notebooks and pages, and each page carries an emoji field used as an icon in the app's sidebar navigation. The emoji update endpoint assigns that field directly from user-supplied input without enforcing a maximum length or filtering newline and whitespace characters, a root cause classed as CWE-840 (Business Logic Errors) - the input is syntactically acceptable to the storage layer but violates the implicit contract that an emoji is a short, single-line glyph. Because the value is persisted and later rendered inside the sidebar's layout container, the oversized, multi-line string escapes the intended icon slot and disrupts the CSS layout for every viewer of that page, hiding sibling navigation entries. The CPE string cpe:2.3:a:nextcloud:collectives:*:*:*:*:*:*:*:* confirms the affected component is the Nextcloud Collectives app rather than the Nextcloud Server core, with no specific version range published. The published CVSS 3.0 vector requires high privileges (PR:H) plus user interaction (UI:R); the independent assessment models the same underlying condition as requiring an authenticated user holding write/edit rights on a collective page, with the disruptive effect only appearing when a second user (UI:R) loads the affected collective and its rendered sidebar.
Know when Nextcloud gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
Editing a page emoji is a normal member/edit action so PR:L (not PR:H); a viewer must load the page (UI:R); impact is client-side layout tampering only, so I:L and C/A:N.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
DescriptionCVE.org
The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Nextcloud server is an open source home cloud implementation. Rated high severity (CVSS 8.8), this vulnerability is remo
A too lax check in Nextcloud Talk 6.0.4, 7.0.2 and 8.0.7 allowed a code injection when a not correctly sanitized talk co
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Rated critical severity (CVSS 9.8),
Unauthenticated OS command injection in the Collabora Online Built-in CODE Server Nextcloud app (richdocumentscode) befo
Unauthenticated vector-store tampering in Nextcloud MCP Server before 0.117.2 lets any network attacker who can reach th
Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.1.2, 9.0.6, and 8.2.9 suffer from SMB User Authenti
NextCloud Cookbook is a recipe library app. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,
Nextcloud server is an open source home cloud implementation. Rated high severity (CVSS 8.8), this vulnerability is remo
Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowi
lib/Controller/ExtractionController.php in the Extract add-on before 1.2.0 for Nextcloud allows Remote Code Execution vi
Authorization bypass in Windmill 1.56.0-1.614.0 enables Operator role users to escalate privileges to remote code execut
Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace the
Exploit-DB