Nextcloud Server EUVD-2026-82623

Requires an authenticated Nextcloud Server user (PR:L) on an instance running the Circles feature, targeting a circle the attacker is not a member of. The exploitation-limiting factor is severe: the attacker must correctly guess the circle's 62^15-space unique identifier, which is computationally infeasible to brute-force, so practical exploitation depends on the attacker already knowing or obtaining a valid circle identifier out-of-band. Impact is limited to reading the circle's membership list; no data modification or service disruption is possible. Affected versions: Nextcloud Server 32.0.0 through 34.0.0.

This is a low-priority vulnerability despite being network-reachable. The vendor CVSS 3.0 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N, score 3.1) is well-calibrated: the impact is limited to disclosure of a circle's membership roster (C:L, no integrity/availability impact), and the AC:H rating is fully justified because exploitation requires guessing a 62^15 (~7.7×10^26) unique identifier - a search space that makes brute-force practically infeasible. Exploitation status: no public exploit identified at time of analysis (HackerOne report #3484601 is a private disclosure channel, no POC published, no EPSS score, not in CISA KEV). No SSVC data is provided. The signals are consistent and all point to low real-world risk: the sole meaningful barrier (the unguessable identifier) is precisely what caps the CVSS and what makes weaponization impractical. Note a minor input inconsistency: the vector string is declared as CVSS:3.0 while the score field is labeled 'CVSS Score: 3.1' - the numeric 3.1 is the base score, not the version; the vector is 3.0.

A user with a valid Nextcloud login account programmatically enumerates circle-membership API endpoints, attempting to retrieve the member list of a private circle they do not belong to. Success requires correctly guessing the circle's 62^15 unique identifier, so absent a leaked identifier this is effectively infeasible; if an attacker already knows or obtains a valid circle ID out-of-band, they can read its membership roster. No public exploit code exists.