CVE-2026-82984
Description
A flaw was found in Nextcloud Server. When a team is configured as visible to all users, the web interface restricts access to non-members, but the underlying resources application programming interface (API) endpoint fails to enforce proper access controls. An authenticated user who is not a team member can directly query the API endpoint to discover and enumerate internal team resources, exposing their existence, names, and identifiers. This flaw results in unauthorized information disclosure, although it does not grant access to the actual contents of the discovered resources.
Statement
Moderate severity is assigned to this flaw because exploitation requires an authenticated account and only discloses object metadata rather than exposing sensitive file contents or affecting system integrity. Nextcloud Server is not included or supported in any Red Hat product offerings.
Community products (Fedora, EPEL) that ship Nextcloud are not affected: the nextcloud package in Fedora and EPEL ships version 34.0.5 (stable updates) and 35.0.2 (testing), which are outside the upstream affected range of 32.0.0-33.0.0 and contain the fix. The nextcloud-client packages are desktop synchronization clients, not the Nextcloud Server application, and are therefore not affected by this server-side vulnerability.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Availability,Access Control
Technical Impact: Read Application Data; Modify Application Data; Execute Unauthorized Code or Commands; Gain Privileges or Assume Identity
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
