Executive brief
Nextcloud Forms is a tool used to create surveys and collect data. A security flaw allowed former collaborators to continue viewing files uploaded by survey respondents even after their access to the form was revoked. This could lead to unauthorized access to sensitive documents or data submitted by users through these forms.
Technical details
A vulnerability classified as CWE-552 (Files or Directories Accessible to External Parties) exists in the Nextcloud Forms application. When a collaborator's access to a form is deleted, the system fails to properly clean up the associated file shares for the folder containing respondent uploads. Consequently, the removed user retains read access to those files via the Nextcloud Files interface. The issue affects versions 4.3.0 through 5.2.6 and is resolved in version 5.2.7 by ensuring file shares are synchronized with collaborator removal. Exploitation requires the attacker to have been a legitimate collaborator on the form previously.
Affected products
- Nextcloud Forms >= 4.3.0, < 5.2.7
Timeline
- 2026-04-14: patched: Fix merged into main branch via pull request 3291
- 2026-05-13: advisory: GitHub security advisory published
- 2026-06-01: disclosed: CVE published to NVD