Nextcloud Deck Improper Encoding and Access Control

Authenticated users with write access to a Nextcloud Deck board can spoof attachment file extensions by embedding Unicode right-to-left override (U+202E) characters in a filename, so a downloaded file is displayed with a trusted extension while its real type differs. The flaw affects Nextcloud Deck before 1.12.7, 1.14.4, and 1.15.1, and requires a second user to view the card and actively choose to download the misleadingly named attachment. Vendor patches (1.12.7, 1.14.4, 1.15.1) strip the RTLO character and render the basename and extension separately; the assessed impact is medium-severity UI spoofing with low real-world urgency, EPSS 0.01% (1st percentile), and no public exploit identified at time of analysis.

Improper permission enforcement in the Nextcloud Deck kanban app allows an authenticated user who has been granted only the board-level 'Can share' right to alter the permission flags of other recipients on that same shared board, rather than being confined to sharing actions. Only Deck versions prior to 1.14.6 (the 1.14.x line) and the 1.15.0-beta.1 pre-release through before 1.15.2 are affected, and any instance where board sharing with multiple recipients is used is exposed; exploitation requires an existing, trusted collaborator account with 'Can share' but not 'Can manage', so anonymous or unauthenticated access is not possible. The impact is rated 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) - a limited integrity effect with no data disclosure or service disruption - and there is no public exploit identified at time of analysis, with EPSS at 0.01% (2nd percentile), making this a low-priority, genuinely low-risk issue; vendor patches are available in 1.14.6 and 1.15.2.