Executive brief
Nextcloud is a collaboration platform used for storing and sharing files. A security flaw causes the system to automatically create hidden public access links when a folder is shared with a 'Team' that includes external email-based members. Because these links are not visible to the folder owner, they cannot be monitored or revoked, potentially allowing unauthorized individuals who obtain the link to view, modify, or delete sensitive company data.
Technical details
A missing authorization and visibility flaw (CWE-862) exists in Nextcloud's 'Circles' or 'Teams' sharing logic. When a user shares a resource with a Team that includes external members (users identified only by email without a local account), the system generates a public access link and emails it to the external party. This link inherits the full permissions of the Team (read/write/delete/reshare) but is not registered in the folder's sharing interface, making it invisible to the owner. An attacker who intercepts or receives this link can perform unauthorized file operations without further authentication. The issue is resolved in versions 32.0.9 and 33.0.3.
Affected products
- Nextcloud Nextcloud Server 32.0.0 to 32.0.8, 33.0.0 to 33.0.2
- Nextcloud Nextcloud Enterprise Server 32.0.0 to 32.0.8, 33.0.0 to 33.0.2
Timeline
- 2026-04-23: patched: Initial pull request to fix share handling in Circles component.
- 2026-05-12: advisory: GitHub Security Advisory published.
- 2026-06-01: disclosed: CVE published to NVD.