Is CVE-2026-104189 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104189 being exploited in the wild.

How severe is CVE-2026-104189?

High severity, with a CVSS score of 7.5, published 27 October 2026.

Which products and versions are affected?

Nextcloud 3D Viewer 1.7.9 through 3.3.1.

How is CVE-2026-104189 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-104189?

Check whether you run Nextcloud 3D Viewer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104189: Nextcloud 3D Viewer password bypass in public file endpoint

CVE-2026-104189 · Severity: high · CVSS 7.5 · Published 2026-10-27

The 3D Viewer app for Nextcloud allows users to share 3D model files via password-protected links. A flaw in how the app validates access to shared files allows anyone with the share link token to bypass the password protection and download the files directly, even when a password was set. This exposes 3D models that users intended to keep secure behind a password.

Vendors: Nextcloud.

Quick answers

Is CVE-2026-104189 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104189 being exploited in the wild.
How severe is CVE-2026-104189?: High severity, with a CVSS score of 7.5, published 27 October 2026.
Which products and versions are affected?: Nextcloud 3D Viewer 1.7.9 through 3.3.1.
Is there a fix for CVE-2026-104189?: Yes: fixed in 3.3.2. Until then: Disable the 3D Viewer app with `occ app:disable threedviewer`, or avoid using password protection on link shares containing 3D model files until upgrading to the patched version. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-104189 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-104189?: Check whether you run Nextcloud 3D Viewer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.3.2

Disable the 3D Viewer app with `occ app:disable threedviewer`, or avoid using password protection on link shares containing 3D model files until upgrading to the patched version.

Technical details

The PublicFileController in the 3D Viewer app extends the base Controller rather than PublicShareController, causing it to bypass Nextcloud's PublicShareMiddleware—which enforces password, expiry, and share-type validation. The vulnerable endpoint GET /ocs/v2.php/apps/threedviewer/public/file/{token}/{fileId} accepts any valid share token and returns the file contents without checking password or share status. This affects only 3D file formats (STL, GLB, glTF, OBJ, STEP, IFC, etc.) that the app handles; non-3D files and expired shares are unaffected.

Affected products

Nextcloud 3D Viewer 1.7.9 through 3.3.1

Timeline

2026-10-27: advisory

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.