HexBrain
Open on HackerOneSign in

Nextcloud · Report #146133

Authentication Issue

Validstatus
$50bounty
19upvotes
25 Oct 2018disclosed

Summary

  1. UserA creates a password protected share
  2. UserA shares this link with UserB
  3. UserB accessed the share with the password
  4. UserA changes the password
  5. Now userB can still access the share.

At step 5 userB should be prompted to authenticate again.

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original