Deck app: Invalid tag color is accepted by API and breaks frontend UI

How it was found

Product / Component

• Application: Nextcloud
• App: Deck
• Feature: Deck → Boards → Tags (Labels)

Vulnerability Type

• Function Confusion
• Improper Input Validation
• Logic Flaw
• Application-level Denial of Service (Feature DoS)

Description

In the Deck app, there is a feature called Deck, which allows users to create Boards. Each board contains Tags (Labels) that can be created and assigned a color for organization.

As a normal user who has access to a board, I attempted to create a new tag. During tag creation, the application sends the following request:

POST /apps/deck/labels HTTP/1.1
Host: 127.0.0.1:8080
requesttoken: <token>
Cookie: <session>

{
  "cardId": null,
  "color": "anything",
  "title": "khoof",
  "boardId": 2
}

The color parameter is supposed to accept only valid color values (for example predefined colors or valid HEX values). However, the server does not validate this parameter at all.

I was able to send any arbitrary string (e.g. "anything") as the color value, and the server responded with:

HTTP/1.1 200 OK

Impact

After creating a tag with an invalid color value:

• The Tags section of the board becomes broken
• Tags no longer render
• The tags management UI does not open
• Users cannot view, edit, or manage tags anymore on that board

This affects all users who have access to the board, not only the attacker.

This results in:

• Permanent functional disruption of the tags feature for the board
• Denial of service at the feature level
• Loss of integrity of board metadata

The issue happens because the backend accepts invalid input that the frontend cannot process or render correctly, causing a function confusion between backend acceptance and frontend expectations.

Attack Scenario

1. Attacker has normal access to a Deck board
2. Attacker sends a crafted request to create a label with an invalid color value
3. Server accepts the request without validation
4. Invalid tag is stored in the database
5. Tags section becomes unusable for all board members

Expected Behavior

• The server should strictly validate the color parameter
• Only allowed color formats (predefined values or valid HEX/RGB formats) should be accepted
• Invalid input should return a 4xx error

Actual Behavior

• Arbitrary values are accepted for the color parameter
• Server responds with 200 OK
• Invalid data breaks the tags rendering and management functionality

Security Impact Summary

• Low privilege user can break core board functionality
• No special permissions required
• Affects multiple users
• Persistent impact until manual backend cleanup

==The PoC Video==

{F5180247}

Impact