Nextcloud Groupfolders EUVD-2026-33671

Requires an authenticated Nextcloud user account (CVSS PR:L confirms low-privilege authentication is sufficient). The exploitable condition is the specific ACL assignment: the user must hold READ permission AND CREATE permission on the target team folder, but must be explicitly denied UPDATE permission - all three conditions must be simultaneously true. The groupfolders plugin must be installed and actively managing the target folder with ACL-based permission controls. Limiting factors: unauthenticated attackers cannot exploit this; users with UPDATE permission are not the exploiting party (they could already rename); users with neither CREATE nor READ cannot access the folder; and organizations not using the groupfolders plugin or not using granular ACL policies (i.e., only basic share permissions) are entirely unaffected.

CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) accurately reflects the limited blast radius: network-accessible, low complexity, but requiring authenticated low-privilege access with a specific permission configuration, yielding only partial integrity impact and no confidentiality or availability degradation. Real-world risk is moderate-to-low in most environments. The flaw is scoped exclusively to installations actively using the groupfolders plugin with fine-grained ACL policies - the specific READ+CREATE-without-UPDATE permission assignment must exist, which is a non-default administrative decision. No EPSS data was provided in the input; no CISA KEV listing exists; and no public exploit has been identified at time of analysis, suggesting this vulnerability has not been broadly targeted by opportunistic attackers. The CVSS integrity impact of 'Low' correctly captures the constraint: an attacker can rename files but cannot read, exfiltrate, or delete them, and cannot escalate scope beyond the team folder. Organizations not deploying groupfolders are entirely unaffected.

An authenticated Nextcloud user who has been granted READ and CREATE access to a team folder - but explicitly denied UPDATE access - issues a rename or move request against an existing file via the Nextcloud web interface or WebDAV API. Because the ACL check in ACLStorageWrapper.php evaluates PERMISSION_UPDATE & PERMISSION_READ (which resolves to zero for distinct bit flags) rather than the intended PERMISSION_UPDATE | PERMISSION_READ, the permission gate passes and the rename succeeds. No public exploit identified at time of analysis; the attack is trivially reproducible by any user aware of their own folder permissions.