Public collectives allow to create pages

How it was found

Summary:

A collective can be explicitly configured to restrict all editing actions to administrators only by applying the following settings:

• Permissions → Allow editing for = Admins only
• Page settings → Default page mode = View

With this configuration, users accessing the collective via a public share link (can edit) are correctly restricted to view-only access in the UI and cannot perform any editing actions. However, despite these restrictive settings, the backend API responsible for page creation does not enforce the collective-level editing policy. As a result, a non-member accessing the collective through a public share link can successfully create new pages by directly calling the page creation API. This behavior bypasses the intended authorization model and demonstrates inconsistent permission enforcement between the UI, collective settings, and backend API.

API:

POST /ocs/v2.php/apps/collectives/api/v1.0/p/collectives/<shareToken>/pages/<parentPageId> (This endpoint is different from report #3530164)

Steps To Reproduce:

1. User A creates a new collective.
2. User A configures the collective with the following settings:

• Permissions → Allow editing for = Admins only
• Page settings → Default page mode = View

{F5302136} 4. User A creates a public share link for the collective with edit permission enabled.

{F5302134} 5. A non-member accesses the collective using the public share link. 6. The UI correctly enforces view-only access and does not allow the user to create or edit pages.

{F5302138} 7. The non-member sends the following API request to create a new page:

POST /ocs/v2.php/apps/collectives/api/v1.0/p/collectives/<shareToken>/pages/<parentPageId>
Content-Type: application/json

{
  "title": "hacker",
  "parentId": <parentPageId>,
  "templateId": null
}

8. The server responds with HTTP 200 OK, and the page is successfully created inside the collective.

{F5302132}

Impact

Although the collective is accessed via a public share link, this behavior violates the intended permission model. The collective is explicitly configured with “Allow editing for: Admins only” and “Default page mode: View”, which are global restrictions intended to limit all write operations to administrators. Allowing a non-member accessing the collective via a public share link to create pages through the backend API grants write privileges beyond what is permitted by the collective-level configuration. This undermines administrative control over the collective’s structure and content, enables unauthorized content creation, and demonstrates an authorization bypass due to missing or inconsistent permission checks in the backend.

VideoPoC: =={F5302125}==

If you have difficulty reproducing the issue, please make sure to use the session cookies of a different logged-in user (i.e., a user who is not the collective owner), rather than making the request without authentication or using a non-logged-in session.