Executive brief
Nextcloud is an open-source platform used for file sharing and collaboration. A security flaw allows logged-in users to bypass password protections or download restrictions on file attachments if they know the specific share token. While an attacker can access these attachments, they cannot access the primary shared file or the entire folder itself.
Technical details
An improper access control vulnerability (CWE-284) exists in the Nextcloud 'Text' application. Authenticated attackers who possess a valid share token can access file attachments by providing a 'documentId' they own, effectively bypassing password protections or download restrictions set on the share. For direct file shares, the attacker only needs the token and their own documentId; for shared folders, the attacker must know or guess a documentId of a file within that folder. The exploit is limited to extracting attachments and does not grant access to the primary shared file or folder. The issue is resolved by ensuring the share token is always validated when provided.
Affected products
- Nextcloud Nextcloud Server 32.0.0 to < 32.0.9, 33.0.0 to < 33.0.3
- Nextcloud Nextcloud Enterprise Server 27.x to < 27.1.11.5, 28.x to < 28.0.14.17, 29.x to < 29.0.16.16, 30.x to < 30.0.17.9, 31.x to < 31.0.14.5, 32.x to < 32.0.9, 33.x to < 33.0.3
Timeline
- 2026-04-22: patched: Fix merged into main branch of Nextcloud Text repository.
- 2026-05-12: advisory: Nextcloud security advisory published.
- 2026-06-01: disclosed: CVE published to NVD.