Vulnerability in Nextcloud Server

CVE-2018-3762

Nextcloud Server before 12.0.8 and 13.0.3 suffers from improper checks of dropped permissions for incoming shares allowing a user to still request previews for files it should not have access to.

EPSS: 0.003 (54.0th percentile) — read the EPSS interpretation.

Affected products

Nextcloud Server — versions <13.0.3, <12.0.8

Weakness classification (CWE)

CWE-284 — Improper Access Control

References

nextcloud.com/security/advisory/ (x_refsource_CONFIRM)
hackerone.com/reports/358339 (x_refsource_MISC)