Nextcloud · Report #2254151
Notes app can be tricked into using a received share created before the user logged in
Validstatus
mediumseverity
49upvotes
19 Jun 2024disclosed
Summary
Security advisory at https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wfqv-cx85-7rjx
Summary: This vulnerability allowed attackers to access and modify other users' notes by tricking "Notes App" into using a received share created before the user logged in.
CVE ID: CVE-2024-37317
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.