Nextcloud Deck CVE-2026-77170

Requires a valid authenticated account on the target Nextcloud instance (PR:L) with access to the Deck app's config API; no user interaction is needed. The core flaw is that the config-setting endpoint accepts an arbitrary board ID and sets board-scoped configuration keys without verifying the caller owns or has manage permission on that board, so the attacker must know or enumerate target board IDs. Limiting factors: exploitation is confined to Deck versions 1.16.0 through 1.18.0, impact is restricted to configuration integrity of the referenced board (no data read, no availability loss), and the attacker cannot act without first obtaining an account on the instance.

This is a low-to-moderate priority authorization flaw, not a high-urgency issue. The vendor CVSS 3.0 base of 4.3 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) is consistent with the description: an authenticated Nextcloud Deck user can write board-scoped configuration keys for board IDs they do not own or manage - an IDOR-style broken access control (CWE-284) with limited integrity impact and no confidentiality or availability impact. Attack complexity is low and no user interaction is required, but PR:L means a valid Nextcloud account is a hard prerequisite, sharply narrowing the practical attacker population to insiders or anyone able to register/obtain an account on the instance. No EPSS score, no CISA KEV listing, and no SSVC decision data were provided in the input, and the single HackerOne reference (report 3599383) is not accessible for POC confirmation, so exploitation likelihood cannot be quantified from the data given - status is 'no public exploit identified at time of analysis'. Signals are internally consistent (no conflict between vector and description). The main uncertainty is the real-world blast radius of tampering with arbitrary boards' config keys, which the terse description does not enumerate; the I:L rating implies it is bounded (nuisance/config manipulation) rather than data theft or takeover.

An authenticated user on a shared Nextcloud instance (e.g., a low-privilege employee or self-registered account) enumerates or guesses numeric board IDs belonging to other users and issues Deck config API requests to set board-scoped configuration keys on those boards without any ownership or management permission being checked. This lets the attacker tamper with the configuration of boards they should have no control over; no public POC was identified in the provided data.