Collectives
Monthly
Persistent sidebar layout manipulation in the Nextcloud Collectives app allows an authenticated user with page-edit permission to submit oversized text containing line breaks to the page emoji update endpoint, which accepts the value without length or character validation. When another user subsequently views the affected collective page, the unvalidated emoji string overflows and breaks the rendered sidebar, hiding other navigation items from view. The impact is confined to client-side layout integrity with no confidentiality or availability loss (CVSS 3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N, published vector 2.4 with PR:H), making this a genuinely low-risk issue; no public exploit code has been identified at time of analysis, and it applies only where the optional Collectives app is installed.
Persistent sidebar layout manipulation in the Nextcloud Collectives app allows an authenticated user with page-edit permission to submit oversized text containing line breaks to the page emoji update endpoint, which accepts the value without length or character validation. When another user subsequently views the affected collective page, the unvalidated emoji string overflows and breaks the rendered sidebar, hiding other navigation items from view. The impact is confined to client-side layout integrity with no confidentiality or availability loss (CVSS 3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N, published vector 2.4 with PR:H), making this a genuinely low-risk issue; no public exploit code has been identified at time of analysis, and it applies only where the optional Collectives app is installed.