Nextcloud · Report #3507273
Email Enumeration via Password-Protected Share Identity Verification
Validstatus
lowseverity
$100bounty
35upvotes
5 Sept 2026disclosed
Summary
Requesting a password for an email share gave different response messages depending if the email address is the share recipient or not, allowing to confirm the intended recipient when someone managed to get access to the share token.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.