Nextcloud · Report #3524971
Users with read-only access to a Nextcloud Table can enumerate its share recipients via the Tables API
Validstatus
lowseverity
12upvotes
27 Oct 2026disclosed
Summary
Security advisory at https://github.com/nextcloud/security-advisories/security/advisories/GHSA-c47x-m7w6-c4q8
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.