CVE-2026-77170
Description
A flaw was found in Deck. Authenticated users can exploit a vulnerability in the Deck config API to set configuration keys for any board, even those they do not own or have permission to manage. This improper access control allows an attacker to perform unauthorized modifications to board configurations, potentially leading to data tampering or disruption of service.
Statement
This flaw is rated as Moderate severity because exploitation requires authenticated network access and the impact is confined to tampering with board-specific configuration parameters without providing system-level access or code execution capabilities. Additionally, Nextcloud Deck is not distributed or supported as part of Red Hat Enterprise Linux or other Red Hat product portfolios.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Access control checks for specific user data or functionality can be bypassed.
Access Control
Technical Impact: Gain Privileges or Assume Identity
Horizontal escalation of privilege is possible (one user can view/modify information of another user).
Access Control
Technical Impact: Gain Privileges or Assume Identity
Vertical escalation of privilege is possible if the user-controlled key is actually a flag that indicates administrator status, allowing the attacker to gain administrative access.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
