Nextcloud Circles SSRF and IDOR

Blind server-side request forgery in the Nextcloud Circles (Teams) app lets any unauthenticated remote user force the Nextcloud Server to issue an outbound GET request to an attacker-chosen internal or private address through the public endpoints POST /apps/circles/event/ and POST /apps/circles/incoming/. The flaw sits in remote-instance signature verification, which fetches the attacker-supplied keyId URL before trust in the remote instance is established and explicitly permits local and private address ranges, bypassing Nextcloud's core SSRF protections. Because the internal response body is never returned to the requester, the practical impact is internal-network reconnaissance - an attacker can map which services are reachable - rather than data theft or code execution; no public exploit code has been identified at time of analysis and the issue is not a confirmed actively exploited (CISA KEV) vulnerability. The independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, treating it as a moderate-severity reconnaissance primitive.

Authorization bypass in Nextcloud Server (Circles feature) lets an authenticated user retrieve the membership list of a circle they do not belong to, exposing membership information for Nextcloud Server 32.0.0 through 34.0.0, as detailed in HackerOne report 3484601. Exploitation is gated by a severe practical constraint: the attacker must supply an existing circle's unique identifier, which lives in a 62^15-space (roughly 90-bit) keyspace, so the CVSS 3.1 score reflects high attack complexity rather than an easily reachable bypass and no public exploit has been identified at time of analysis. Impact is limited to confidentiality of one circle's member list; no modification, deletion, or service disruption is possible, making this a low-priority issue for most deployments.