Nextcloud Whiteboard CVE-2026-87897

The attacker must hold a low-privileged authenticated account (PR:L) on a Nextcloud instance that has the Whiteboard app with its recording feature in use. Exploitation depends on a victim starting a recording - the recording backend invokes a headless Chrome instance exposing the Chrome DevTools Protocol, and the SSRF reaches that internal CDP API to leak the victim's JWT (UI:R, passive victim action). Limiting factors: requires valid credentials on the same instance, requires the recording feature to be deployed and actively used, requires the attacker to continually poll/exploit to catch the token at the moment of recording, and impact is scoped to the victim's whiteboard (read/write) rather than full account compromise.

This is a medium-severity issue (CVSS 4.6) whose signals point to a targeted, conditional attack rather than a widespread, easily-weaponized one. The CVSS 3.0 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) shows network reach but requires an authenticated low-privileged account (PR:L) and victim user interaction (UI:R) - specifically the victim starting a recording - which materially constrains real-world exploitability. No EPSS score and no KEV listing are present in the input, so there is no evidence of active exploitation or high predicted exploitation probability; absence of these is not itself reassurance, but combined with the UI/privilege requirements it suggests this is not a mass-exploitable flaw. A public PoC reference exists (a HackerOne report) but it is not verified as working exploit code, so POC availability should not be treated as confirmed active exploitation - these are distinct signals. The vuln.today decision label is 'this_month', indicating a patch-on-normal-cadence priority rather than an emergency. Net: a legitimate but moderate priority - worth patching within the vendor's maintenance window, driven by the confidentiality/integrity impact on another user's whiteboard, not by evidence of broad exploitation.

A low-privileged authenticated user on a shared Nextcloud instance running the Whiteboard app repeatedly issues SSRF requests (CWE-918) that reach the internal Chrome DevTools Protocol API used by the whiteboard recording backend. When a victim starts a recording, the attacker captures the victim's leaked JWT authentication token and uses it to gain read/write access to the victim's whiteboard. A HackerOne report reference exists but is not verified as working exploit code.