Whiteboard
Monthly
Server-side request forgery in the Nextcloud Whiteboard app lets an authenticated low-privileged user force the recording backend to reach an internal Chrome DevTools Protocol API and leak another user's JWT authentication token, granting read/write access to that victim's whiteboard. The attacker must hold a valid account on the same Nextcloud instance and repeatedly poll the SSRF while a victim starts a recording, so the victim's own action is a prerequisite (UI:R) and successful capture is timing-dependent. Scored 4.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) and rated this_month by vuln.today; no public exploit code was identified at time of analysis and the issue is not in CISA KEV, so the realistic risk is targeted, conditional abuse rather than mass scanning.
Server-side request forgery in the Nextcloud Whiteboard app lets an authenticated low-privileged user force the recording backend to reach an internal Chrome DevTools Protocol API and leak another user's JWT authentication token, granting read/write access to that victim's whiteboard. The attacker must hold a valid account on the same Nextcloud instance and repeatedly poll the SSRF while a victim starts a recording, so the victim's own action is a prerequisite (UI:R) and successful capture is timing-dependent. Scored 4.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) and rated this_month by vuln.today; no public exploit code was identified at time of analysis and the issue is not in CISA KEV, so the realistic risk is targeted, conditional abuse rather than mass scanning.