Executive brief
Nextcloud is an open-source platform used for file sharing and team collaboration. A security flaw in the 'Circles' feature could allow a user to track the membership of private groups if they obtain a specific group ID. While the IDs are highly complex and difficult to guess, an attacker with prior knowledge of an ID could use this to monitor group activity, potentially compromising the privacy of internal team structures.
Technical details
An authorization bypass (CWE-639) exists in the Nextcloud Circles API due to a missing access check. This vulnerability allows an authenticated attacker to add a private circle to another circle using its unique ID. While the high entropy of circle IDs (62^15) makes brute-force attacks impractical, an attacker who has obtained a circle ID through other means can exploit this to track memberships. The attack requires low privileges and some user interaction, with high attack complexity due to the requirement of knowing the target ID. Patches are available in Nextcloud Server versions 32.0.7 and 33.0.1, and various Enterprise Server maintenance releases.
Affected products
- Nextcloud Nextcloud Server 32.0.0 to 32.0.6, 33.0.0
- Nextcloud Nextcloud Enterprise Server 29.0.0 to 29.0.16.13, 30.0.0 to 30.0.17.7, 31.0.0 to 31.0.14.2, 32.0.0 to 32.0.6, 33.0.0
Timeline
- 2026-03-17: patched: Fix merged in GitHub repository
- 2026-05-12: advisory: GitHub Security Advisory published
- 2026-06-01: disclosed: CVE published to NVD