EUVD-2026-111126Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as any Nextcloud user
-
ExploitIdentify team set to 'visible to everyone'
-
ExecutionCall resources API endpoint directly
-
ImpactEnumerate resource names and identifiers
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) a team in the Nextcloud instance explicitly configured with the 'visible to everyone' setting, and (2) the attacker holding a valid authenticated Nextcloud account that is a non-member of that team. The flaw is that the resources API endpoint does not enforce the membership check that the web UI applies, so a direct API call succeeds. Limiting factors: authentication is mandatory (PR:L), only teams set to 'visible to everyone' are affected, and the disclosure is confined to resource existence, names, and identifiers - resource contents remain protected, and there is no integrity or availability impact. |
| Impact | This is a low-to-moderate priority information-disclosure flaw rather than an urgent threat. The CVSS 3.0 base score is 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N, meaning it is remotely reachable and low-complexity but requires an authenticated account (PR:L) and only yields low confidentiality impact (C:L, I:N, A:N) - the disclosure is limited to the existence, names, and identifiers of team resources, not their contents. The vuln.today decision label is 'this_month', consistent with a non-emergency, schedule-the-patch posture. It is NOT in CISA KEV and no EPSS score was supplied, so there is no evidence of active or widespread exploitation; absence of EPSS/KEV is not itself a risk signal but means probability of exploitation cannot be quantified from this data. A public PoC reference exists (the HackerOne report) but it is not verified as working exploit code. The signals are internally consistent: a genuine but bounded access-control defect that primarily aids reconnaissance against a Nextcloud instance where the attacker already has a login. Note the input Tags label this 'Authentication Bypass', but the description and CWE-284 make clear authentication is intact and only authorization/access control fails - treat it as an authorization bypass. |
| Exploit ScenarioDerived | An authenticated Nextcloud user who is not a member of a team configured as 'visible to everyone' bypasses the web UI's membership check by calling the resources API endpoint directly, returning the names and identifiers of that team's internal resources. A public PoC reference exists (HackerOne report #3511955), though it is not verified as working exploit code. The attacker gains metadata for reconnaissance but cannot read the resource contents themselves. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Information disclosure in Nextcloud Server 32.x through 33.x lets any authenticated user who is not a member of a team configured as 'visible to everyone' enumerate that team's internal resource names and identifiers by calling the resources API endpoint directly, even though the web UI correctly returns a 'You are not a member of ...' block. The disclosure is limited to the existence, names and identifiers of resources - their contents remain protected - and there is no integrity or availability impact, which is consistent with the assessed CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/C:L/I:N/A:N (4.3). This is a low-to-moderate priority authorization-consistency bug rather than an urgent threat: no CISA KEV listing or public exploit code is confirmed in the available sources, and per the vuln.today decision label it is triaged for handling this month.
RemediationAI
No vendor-released fixed version is identified in the supplied intelligence, so the primary action is to track the Nextcloud security advisories and the upstream fix for the resources API authorization check, then upgrade the server once a patched release in the 32.x/33.x branches is published; consult https://hackerone.com/reports/3511955 and https://vuldb.com/vuln/427435 for updates. Until then, the effective compensating control is to remove the exposure condition: change any team currently set to 'visible to everyone' to a members-only visibility if cross-instance discoverability of that team is not required, which eliminates the unauthenticated-membership metadata enumeration at the cost of losing that team's directory visibility. Where such visibility must be retained, restrict reach to the resources API endpoint at the reverse proxy or WAF for users outside the relevant teams, accepting that this breaks the endpoint for legitimate members unless the rule is carefully scoped, and note that the web UI check alone is not sufficient because the direct API call bypasses it. Because exploitation requires a valid authenticated account, reviewing accounts and tightening who can hold a Nextcloud login reduces the pool of potential enumerators, and reviewing the disclosed identifiers for any follow-on targeted requests is worthwhile given that names and IDs are the only leaked data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Nextcloud Server ships a Teams collaboration feature whose resources API exposes the objects owned by a team. The root cause is classified as CWE-284 (Improper Access Control): the membership check that the web UI applies when rendering a team page is not enforced at the API layer, so the two access paths disagree and the API route becomes an alternate, unauthorized channel to the same data. The EUVD/CPE data identifies the affected package as cpe:2.3:a:nextcloud:server, i.e. the core server product rather than a standalone app, and exploitation requires a team explicitly set to the 'visible to everyone' visibility mode plus a valid authenticated account that is a non-member of that team - a visibility setting is what makes the team discoverable, but membership is what should gate its resource listing. The flaw yields only metadata disclosure (resource existence, names and identifiers); resource contents, and therefore confidentiality of the underlying documents and objects, are not exposed, and nothing in the available sources indicates a write or denial-of-service path. The precise API route, parameter names and the code-level location of the missing check are not described in the supplied intelligence, and the trigger is only characterized as a direct call to the resources endpoint.
Know when Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Remote API call (AV:N), low complexity (AC:L), requires any authenticated account so PR:L, no user interaction; only metadata disclosed so C:L, I:N, A:N.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
DescriptionCVE.org
When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be called directly, allowing any authenticated non-member to enumerate the team's internal resources and their identifiers.
This does not grant access to the contents of the discovered resources themselves, only their existence, names, and identifiers.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Traccar Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of Generation of Code ('Code Injectio
Account takeover in self-hosted Bitwarden Server before 2026.6.0 lets a low-privileged organization member steal any oth
Full user impersonation in the Laci Synchroni sync server (backend prior to 1.2.3) lets an attacker take over any accoun
Provider service users in Bitwarden Server Cloud can hijack arbitrary organizations via unauthorized API endpoint access
NoMachine Server is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack compl
NoMachine Server is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack comple
Authentication bypass in Bitwarden Server versions prior to 2026.4.1 allows authenticated users with SCIM management pri
JetAudio jetCast Server 2.0 contains a stack-based buffer overflow vulnerability in the Log Directory configuration fiel
Credential-holding attackers can completely bypass TOTP two-factor authentication on Sync-in Server versions prior to 2.
A broken authentication vulnerability in 4D SAS 4D Server software v17, v18, v19 R7, and earlier allows attackers to sen
An information disclosure vulnerability in 4D SAS 4D Server Application v17, v18, v19 R7 and earlier allows attackers to
Privilege escalation in self-hosted Bitwarden Server before 2026.5.0 lets an authenticated organization member holding a
GitHub PoC
Exploit-DB