HexBrain

Nextcloud · Report #1200810

Admin audit is not properly logging unsetting of expiration date

Validstatus
lowseverity
10upvotes
15 Jul 2021disclosed

How it was found

In relation to https://hackerone.com/reports/1177353

  1. Enable the audit log
  2. Share a file
  3. Set and expiration date

So far all looks good in the log

  1. Unset the the expiration date.
  2. See a pretty useless log line

Impact

The audit log is used to get a full trail of the actions which is now incompletely. With possible important information. It seems to be also listed on https://portal.nextcloud.com/article/using-the-audit-log-44.html

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original