Executive brief
Nextcloud Forms is a tool used for creating and managing surveys and data collection forms. A security flaw in the application allowed logged-in users to view form responses submitted by other people without proper authorization. This could lead to the exposure of sensitive personal or business information collected through these forms.
Technical details
A missing authorization check (CWE-862) in the Nextcloud Forms application allowed authenticated users to access form submissions they were not authorized to view. The vulnerability resided in the ApiController where submission visibility was not properly enforced based on user permissions. An attacker with a valid account on the Nextcloud instance could exploit this by sending crafted network requests to the API to retrieve sensitive information (CWE-200) from other users' form responses. The issue has been resolved in version 5.2.6 by implementing proper permission validation in the submission handling logic.
Affected products
- Nextcloud Forms < 5.2.6
Timeline
- 2026-04-04: other: Fix developed in pull request
- 2026-05-12: advisory: Vendor security advisory published
- 2026-06-01: disclosed: CVE published to NVD