Deck
Monthly
An authenticated user on a Nextcloud instance running the Deck app can set board-scoped configuration keys for arbitrary board IDs via the Deck config API, because the endpoint does not verify that the caller owns or has manage permission on the referenced board. Only Deck 1.16.0 through 1.18.0 are affected, and the impact is confined to configuration integrity of the targeted board - there is no data disclosure or availability loss - making this a low-to-moderate priority authorization flaw rather than a high-urgency issue. Exploitation requires a valid account on the instance (the assessed vector is PR:L, i.e. authenticated, with no user interaction), and the attacker must know or enumerate target board IDs; no public exploit code has been identified at time of analysis.
Improper permission enforcement in the Nextcloud Deck kanban app allows an authenticated user who has been granted only the board-level 'Can share' right to alter the permission flags of other recipients on that same shared board, rather than being confined to sharing actions. Only Deck versions prior to 1.14.6 (the 1.14.x line) and the 1.15.0-beta.1 pre-release through before 1.15.2 are affected, and any instance where board sharing with multiple recipients is used is exposed; exploitation requires an existing, trusted collaborator account with 'Can share' but not 'Can manage', so anonymous or unauthenticated access is not possible. The impact is rated 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) - a limited integrity effect with no data disclosure or service disruption - and there is no public exploit identified at time of analysis, with EPSS at 0.01% (2nd percentile), making this a low-priority, genuinely low-risk issue; vendor patches are available in 1.14.6 and 1.15.2.
Authenticated users with write access to a Nextcloud Deck board can spoof attachment file extensions by embedding Unicode right-to-left override (U+202E) characters in a filename, so a downloaded file is displayed with a trusted extension while its real type differs. The flaw affects Nextcloud Deck before 1.12.7, 1.14.4, and 1.15.1, and requires a second user to view the card and actively choose to download the misleadingly named attachment. Vendor patches (1.12.7, 1.14.4, 1.15.1) strip the RTLO character and render the basename and extension separately; the assessed impact is medium-severity UI spoofing with low real-world urgency, EPSS 0.01% (1st percentile), and no public exploit identified at time of analysis.
Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Nextcloud Deck is a Kanban-style project & personal management tool for Nextcloud. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Nextcloud Deck is a Kanban-style project & personal management tool for Nextcloud, similar to Trello. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Nextcloud is an open-source, self-hosted productivity platform. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
Deck is an open source kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Nextcloud Deck before 1.2.7, 1.4.1 suffers from an information disclosure vulnerability when searches for sharees utilize the lookup server by default instead of only the local Nextcloud server. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing access control in Nextcloud Deck 1.0.4 caused an insecure direct object reference allowing an attacker to view all attachments. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Improper access control in Nextcloud Deck 0.8.0 allowed an attacker to reshare boards shared with them with more permissions than they had themselves. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Improper access control in Nextcloud Deck 1.0.0 allowed an attacker to inject tasks into other users decks. Rated medium severity (CVSS 4.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An authenticated user on a Nextcloud instance running the Deck app can set board-scoped configuration keys for arbitrary board IDs via the Deck config API, because the endpoint does not verify that the caller owns or has manage permission on the referenced board. Only Deck 1.16.0 through 1.18.0 are affected, and the impact is confined to configuration integrity of the targeted board - there is no data disclosure or availability loss - making this a low-to-moderate priority authorization flaw rather than a high-urgency issue. Exploitation requires a valid account on the instance (the assessed vector is PR:L, i.e. authenticated, with no user interaction), and the attacker must know or enumerate target board IDs; no public exploit code has been identified at time of analysis.
Improper permission enforcement in the Nextcloud Deck kanban app allows an authenticated user who has been granted only the board-level 'Can share' right to alter the permission flags of other recipients on that same shared board, rather than being confined to sharing actions. Only Deck versions prior to 1.14.6 (the 1.14.x line) and the 1.15.0-beta.1 pre-release through before 1.15.2 are affected, and any instance where board sharing with multiple recipients is used is exposed; exploitation requires an existing, trusted collaborator account with 'Can share' but not 'Can manage', so anonymous or unauthenticated access is not possible. The impact is rated 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) - a limited integrity effect with no data disclosure or service disruption - and there is no public exploit identified at time of analysis, with EPSS at 0.01% (2nd percentile), making this a low-priority, genuinely low-risk issue; vendor patches are available in 1.14.6 and 1.15.2.
Authenticated users with write access to a Nextcloud Deck board can spoof attachment file extensions by embedding Unicode right-to-left override (U+202E) characters in a filename, so a downloaded file is displayed with a trusted extension while its real type differs. The flaw affects Nextcloud Deck before 1.12.7, 1.14.4, and 1.15.1, and requires a second user to view the card and actively choose to download the misleadingly named attachment. Vendor patches (1.12.7, 1.14.4, 1.15.1) strip the RTLO character and render the basename and extension separately; the assessed impact is medium-severity UI spoofing with low real-world urgency, EPSS 0.01% (1st percentile), and no public exploit identified at time of analysis.
Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Nextcloud Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Nextcloud Deck is a Kanban-style project & personal management tool for Nextcloud. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Nextcloud Deck is a Kanban-style project & personal management tool for Nextcloud, similar to Trello. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Nextcloud is an open-source, self-hosted productivity platform. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
Deck is an open source kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Nextcloud Deck before 1.2.7, 1.4.1 suffers from an information disclosure vulnerability when searches for sharees utilize the lookup server by default instead of only the local Nextcloud server. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Missing access control in Nextcloud Deck 1.0.4 caused an insecure direct object reference allowing an attacker to view all attachments. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Improper access control in Nextcloud Deck 0.8.0 allowed an attacker to reshare boards shared with them with more permissions than they had themselves. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Improper access control in Nextcloud Deck 1.0.0 allowed an attacker to inject tasks into other users decks. Rated medium severity (CVSS 4.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.