Nextcloud · Report #3620539
Public shares remain accessible via alternate endpoints after owner account is disabled
Validstatus
mediumseverity
$270bounty
6upvotes
27 Oct 2026disclosed
Summary
Security advisory at https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6m4h-j3wr-v388
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.