Nextcloud Richdocuments EUVD-2026-111129

Exploitation requires (1) a deployment of the Nextcloud Richdocuments app (the Collabora/WOPI integration) at version 11.0.0 or earlier, and (2) possession of a valid WOPI access token of the 'user' or 'guest' type - the flaw is that the configuration endpoint does not verify the token type, so a lower-privilege guest/user token is accepted where it should not be. Limiting factors: the attacker must already hold such a token (PR:L), so fully anonymous exploitation is not possible; impact is confined to disclosure of additional WOPI configuration data (C:L, with no integrity or availability effect); and exposure is bounded to the listed vulnerable version range. The input also marks UI:R, which would require some user interaction, though the description does not specify such a step.

This is a low-severity information-disclosure issue, and the signals are consistent in pointing to low real-world priority rather than a high-CVSS-but-overstated finding. The supplied CVSS 3.0 base score is 3.5 (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N): network vector but requiring privileges (PR:L - a user or guest token) and yielding only low confidentiality impact with no integrity or availability impact. The vuln.today Decision label is 'monitor', the lowest urgency tier, which aligns with the low score. No EPSS probability is provided in the input, so exploitation likelihood cannot be quantified from this data. The CVE is NOT on CISA KEV and there is no confirmation of active exploitation. A public report reference exists (HackerOne #3568116) but it is not verified as working exploit code. The only material caveat is the authentication requirement: PR:L here can mean a guest token, which in collaborative-editing deployments may be relatively easy to obtain, so the 'privileges required' barrier is weaker than PR:L might suggest for an internal-admin-only system. Even so, the impact ceiling is leakage of additional WOPI configuration information (C:L), not credentials or document contents, keeping overall risk low. Note one discrepancy to verify with the vendor: the input vector asserts UI:R (user interaction required), yet the description - retrieving configuration data by presenting a token of the wrong type - does not describe any user-interaction step, which would normally imply UI:N.

An attacker who holds a valid Nextcloud WOPI user or guest token (for example a guest granted collaborative access to a shared document) presents that token to a WOPI configuration endpoint that fails to verify the token type, and receives additional WOPI configuration details it should not be exposed to. A public PoC reference exists (HackerOne report #3568116); it is not verified as working exploit code. Because the attack is network-reachable (AV:N) with low complexity (AC:L) but needs a token (PR:L) and discloses only low-sensitivity configuration data (C:L), the practical payoff is limited to reconnaissance.