Nextcloud Server CVE-2026-82985

Requires that the album owner has already shared a filter-based 'smart album' (an album whose contents are defined by search filters) with the attacker; without such a share there is no access. The attacker must be an authenticated Nextcloud user (PR:L) and must modify their own photosSourceFolders search-folder configuration to widen the resolved file set. Limiting factors: the vulnerability only exposes the owner's file *metadata* (name, file ID, attributes) - not file content - and only within the scope reachable via the smart album's filter, and it cannot reach files of users who have not shared such an album with the attacker.

This is a moderate, tightly-scoped authorization flaw (CWE-284) in the Nextcloud Server Photos app. The provided CVSS 3.0 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N = 6.5) correctly captures a confidentiality-only, network-reachable, authenticated issue with no integrity or availability impact. The C:H rating is arguably aggressive: the flaw discloses only file metadata (names, file IDs, other attributes) - not file contents - so I lean toward C:L, which would lower the score to ~4.3. Exploitation is strongly gated: the attacker must be a user with whom the album owner has *already shared* a filter-based smart album; there is no path to arbitrary users' files. No EPSS score, KEV listing, or POC is present in the input, so exploitation status is: no public exploit identified at time of analysis. This is a legitimate privacy/authorization bug worth patching but is not a widespread-exploitation priority - the trust prerequisite (an existing share to the attacker) and metadata-only disclosure keep real-world risk low-to-moderate. Note the EUVD affected-version string 'Server 32.0.0 <32.0.0' is malformed/contradictory and should be verified against the vendor advisory.

A Nextcloud user is shared a filter-based smart album by another user. Because the smart album resolves its file listing using the *recipient's* photosSourceFolders search configuration rather than the owner's, the recipient configures their own search folders to enumerate the owner's files (names, IDs, metadata) in folders the owner never meant to expose. No public exploit code is identified; exploitation is manual and requires an existing share relationship.