Team Folders
Monthly
Authorization bypass in the Nextcloud team folders app (formerly group folders), when used together with the workspace app, allows authenticated delegated administrators to reach folders outside the scope they were granted. Affected are Nextcloud deployments where organizations delegate limited team-folder administration strictly through API/REST; the attacker must already hold advanced permissions on at least some folders (CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N, score 6.5), so unauthenticated users and ordinary accounts cannot exploit it. Confidentiality and integrity of folders outside the delegated scope are both compromised, availability is not affected, and no public exploit code has been identified at time of analysis - the CVE is not listed in CISA KEV, and the report originates from HackerOne (report 3674940).
Authorization bypass in the Nextcloud team folders app (formerly group folders), when used together with the workspace app, allows authenticated delegated administrators to reach folders outside the scope they were granted. Affected are Nextcloud deployments where organizations delegate limited team-folder administration strictly through API/REST; the attacker must already hold advanced permissions on at least some folders (CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N, score 6.5), so unauthenticated users and ordinary accounts cannot exploit it. Confidentiality and integrity of folders outside the delegated scope are both compromised, availability is not affected, and no public exploit code has been identified at time of analysis - the CVE is not listed in CISA KEV, and the report originates from HackerOne (report 3674940).