Executive brief
Nextcloud Circles is a collaboration feature that allows users to organize into groups. An unauthenticated attacker can force the server to make requests to internal addresses by crafting malicious requests to the public event endpoints, bypassing the server's normal protections against such requests. While the attacker cannot read sensitive data returned by these internal services, they can probe which internal services are running and reachable.
Technical details
This is a blind server-side request forgery (SSRF) vulnerability in Nextcloud Circles' remote-instance signature verification logic. The vulnerability occurs because the code fetches an attacker-supplied keyId URL before validating trust in the remote instance, and explicitly bypasses Nextcloud's core SSRF protections to allow requests to private and local addresses. The public, unauthenticated endpoints POST /apps/circles/event/ and POST /apps/circles/incoming/ are reachable without authentication and trigger this code path. An unauthenticated attacker can exploit this to force the server to issue GET requests to internal addresses; however, the response body is never returned to the requester, limiting impact to service discovery and reachability probing.
Affected products
- Nextcloud Circles <UNKNOWN>
Timeline
- 2026-09-18: disclosed