Nextcloud · Report #549831
External Storage - WebDAV - New user has access to storage from deleted user (same user-ID)
Validstatus
2upvotes
14 Feb 2021disclosed
How it was found
- Delete existing user account "user3"
- Create new user account "user3"
Also reported on https://github.com/nextcloud/server/issues/15258
Impact
Newly created user with same user-id of a deleted user has access to the configured external webdav storage from the deleted user.