Nextcloud · Report #3511998
Private circle can be added to another circle via API despite visibility restriction
Validstatus
lowseverity
$150bounty
87upvotes
8 May 2026disclosed
Summary
Security advisory at https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xpgv-grf9-gm7x
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.