Nextcloud · Report #198012
Disclosure of administrators via JSON on nextcloud.com Wordpress
Validstatus
12upvotes
13 Jan 2017disclosed
Summary
@rbcafe reported the following issue, since it contains references to internal data we've decided to disclose this issue only limitedly.
Greetings,
Description :
Since the update of the website to wordpress 4.7 the JSON discloses administrators :
POC :
https://nextcloud.com/wp-json/wp/v2/users
Best regards @Rbcafe
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.