EUVD-2026-82618
GHSA-v94x-5qwj-fqpj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as delegated team-folder admin
-
ExploitIssue API/REST call for out-of-scope folder
-
ExecutionServer skips folder-level authorization check
-
ImpactRead or modify unauthorized team folder contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires both the Nextcloud team folders (formerly group folders) app AND the workspace app to be installed and in use together, with the organization delegating limited team-folder administration via API/REST only. The attacker must be an authenticated delegated administrator (PR:H) who has advanced permissions on at least some folders; the flaw lets them reach folders outside that authorized scope. Limiting factors: it is not exploitable by unauthenticated or ordinary users, is confined to deployments using this specific app combination and delegation model, and has no availability impact. |
| Impact | This is a genuine but moderate-severity authorization flaw, not a top-tier emergency. The vendor CVSS3.0 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N = 6.5 Medium) is the only quantitative signal provided: no EPSS score, no CISA KEV listing, and no SSVC decision data accompany this record. The PR:H metric is the key limiter - exploitation is not open to anonymous internet attackers but is confined to accounts that have already been granted delegated team-folder administration via the workspace app. The C:H/I:H/A:N shape correctly reflects that a delegated admin can read and modify team folders beyond their authorized scope but cannot degrade availability. The 'Authentication Bypass' tag conflicts with the actual mechanism and CWE-284: this is authorization escalation by an already-authenticated delegated admin, not a bypass of authentication itself - treat the tag as inaccurate. Bottom line: real and worth patching for organizations that use both the team folders and workspace apps with delegated administration, but the high-privilege precondition and absence of exploitation evidence place it well below internet-facing unauthenticated criticals. |
| Exploit ScenarioDerived | An organization uses Nextcloud team folders alongside the workspace app to give a departmental admin API/REST-only management rights over a limited set of team folders. That delegated admin issues crafted API/REST calls that are not properly checked against folder-level authorization, letting them view or alter folders for which they were never granted advanced permissions. No public exploit code is identified; the issue was disclosed via HackerOne report #3674940. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 18, 2026
Authorization bypass in the Nextcloud team folders app (formerly group folders), when used together with the workspace app, allows authenticated delegated administrators to reach folders outside the scope they were granted. Affected are Nextcloud deployments where organizations delegate limited team-folder administration strictly through API/REST; the attacker must already hold advanced permissions on at least some folders (CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N, score 6.5), so unauthenticated users and ordinary accounts cannot exploit it. Confidentiality and integrity of folders outside the delegated scope are both compromised, availability is not affected, and no public exploit code has been identified at time of analysis - the CVE is not listed in CISA KEV, and the report originates from HackerOne (report 3674940).
RemediationAI
No vendor-released patch has been identified at time of analysis; the only available reference is the HackerOne report 3674940 (https://hackerone.com/reports/3674940), so the first step is to check Nextcloud's security advisory feed and the team folders and workspace app release notes for a fixed app version and upgrade as soon as one is published rather than assuming no fix exists. Until then, apply targeted compensating controls: the highest-value change is to stop delegating team-folder administration through the API/REST-only path (disable or remove that workspace-app delegation configuration), which closes the bypass entirely at the cost of losing the delegated-admin workflow and forcing folder management back onto full administrators or manual processes. If that workflow cannot be removed, restrict the delegated API/REST surface - terminate the API behind a reverse proxy that enforces an IP allowlist or an additional authentication layer, and issue delegated tokens only to the automation systems that genuinely require them - accepting that this can break legitimate remote or mobile clients and scripted integrations. In parallel, audit every existing delegated administrator, reduce their assignments to the minimum folder set with advanced permissions, and rotate their credentials, since the bypass only matters for accounts whose scope is deliberately limited. Because the technique is per-request and produces no crash, enable and review Nextcloud API and audit logs for delegated-admin requests that enumerate or modify folders outside their granted scope, and treat such events as active exploitation attempts; log-based detection is a detective rather than preventive control, so it should complement, not replace, removing the delegation path.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is an authorization-control weakness classified as CWE-284 (Improper Access Control) in the Nextcloud team folders app, tracked under CPE cpe:2.3:a:nextcloud:team_folders:*:*:*:*:*:*:*:*. Nightcloud's team folders app (historically named group folders) provides shared, centrally managed folders, while the workspace app layers on delegated administration: it lets an organization create limited administrators who can manage team folders only through the API/REST interface, and only for folders on which they hold advanced permissions. The vulnerability is that this folder-level authorization constraint is not enforced consistently for API/REST requests issued by such delegated administrators, so the API path effectively skips the per-folder scope check that the normal UI path would apply. Exploitation therefore requires a specific deployment topology - both apps installed, the workspace app configured to delegate team-folder management via API/REST only, and the attacker holding an authenticated delegated-admin role (PR:H) with advanced permissions on at least one folder - which explains the moderate 6.5 score despite the high confidentiality and integrity impact: the flaw yields lateral access to sibling folders rather than a pre-authentication or server-level compromise, and it has no availability impact.
Know when Team Folders gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Requires an authenticated delegated admin (PR:H) making network API/REST calls with no user interaction; grants read and write to unauthorized folders (C:H/I:H) but no availability impact.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed API/REST-only delegated administrators to bypass folder-level authorization controls. The workspace app enables organizations to delegate limited administrative privileges for team folder management via API/REST only, restricting access to folders for which the admin has advanced permissions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB