Nextcloud · Report #1675014
Profile of disabled user stays accessible
Validstatus
lowseverity
$100bounty
27upvotes
26 Nov 2022disclosed
Summary
Security advisory at https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8f3p-rcm5-mrg3
How it was found
Userprofiles of disabled users keep staying accessible. on DOMAIN/u/USERID This is quite undesirable as this user has no way to clear or modify this data in case they do not want it exposed anymore. I'd assume profiles of disabled users would not be visible to ensure they can always be in control of their own data.
Impact
exposure of user info that they can't control anymore.