Nextcloud Tables CVE-2026-82986

Exploitation requires an authenticated Nextcloud user account that is a member of a group for which an administrator has explicitly configured a restriction on link sharing in Nextcloud Tables; the user must already have access to a table. The flaw is only meaningful where such a group-level link-sharing restriction has actually been set - on default installs with no restriction there is nothing to bypass. Limiting factors: the Tables app (versions 0.6.4 through 1.0.0) must be installed, the attacker must hold valid low-privilege credentials (PR:L), and impact is confined to data in tables the user can already reach, which caps confidentiality and integrity impact at Low.

This is a moderate-severity authorization (access-control) flaw, not a high-priority emergency. The supplied CVSS 3.0 vector (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N, base 4.6) indicates a network-reachable issue but one that requires an authenticated, low-privileged account (PR:L) and offers only Low confidentiality and Low integrity impact with no availability impact. The vuln.today decision label is 'this_month' (not act_now or emergency), which aligns with the medium CVSS. No EPSS score and no CISA KEV status are provided in the input, and there is no field asserting a confirmed working exploit; the only reference is a HackerOne disclosure report. Signals are therefore consistent rather than conflicting: a real but bounded issue affecting the integrity of an administrator's sharing policy, not a mass-exploitable RCE. Missing data to note explicitly: no EPSS probability and no KEV confirmation were supplied, so widespread or active exploitation cannot be asserted; the fixed version is not stated in the evidence.

An authenticated Nextcloud user who belongs to a group that an administrator has explicitly barred from creating link shares invokes the share-link function on a Tables table anyway, and the restriction is not enforced. The resulting public share link exposes the table's data (and potentially edit access) outside the policy the administrator intended. A HackerOne report reference exists for this issue; it is not verified as working exploit code.