Mail contact autocomplete bypasses administrator-configured user enumeration restrictions and expose member information outside the intended scope

How it was found

Summary:

An authenticated user can enumerate other users' directory entries, including ID, display name, and email address, even when the instance is configured to restrict user enumeration to same-group or exact-match scenarios.

The attacker-controlled entry point is the partial search term sent to ContactIntegrationController::autoComplete() on the email composition page. That handler forwards the term into ContactsIntegration::getContactsWithName(), which calls doSearch(). doSearch() only checks core.shareapi_allow_share_dialog_user_enumeration; it does not apply the stricter share-enumeration controls that the product uses elsewhere, such as shareapi_restrict_user_enumeration_to_group and the related full-match restrictions.

Steps To Reproduce (including PoC):

I used "github.com/juliusknorr/nextcloud-docker-dev" as test environment.

• Nextcloud version: Nextcloud Hub 26 Winter (34.0.0 dev)
• Nextcloud Mail version: 5.7.4

1. Login as admin and add Mail app.

{F5573031}

2. Create two groups (e.g., g1, g2) and assign one user to each group (e.g., Alice to g1 and Bob to g2).

{F5573036}

3. Set "Restrict account name autocompletion and system address book access to users within the same groups" as checked at Administration Settings > Sharing > Privacy settings for sharing. This should make it so that Alice can’t find Bob.

{F5573054}

4. Logout and login as Alice. Go to the Mail tab and link any email service. Click New message.

{F5573061}

5. Open Devtools offered by browser (I used Firefox). Type @b or something like @{keyword} in Write message ... textarea block. The members of unauthorized group will be enumerated in the Response from HTTP GET http://nextcloud.local/index.php/apps/mail/api/contactIntegration/autoComplete/{keyword}query.

{F5573074}

Impact

An authenticated user can bypass an administrator-configured user-enumeration restriction and enumerate users outside their allowed group scope, disclosing other groups' user identifiers, display names, and email addresses.