CVE Feed

    Dashboard / CVE / CVE-2026-82984

    CVE-2026-82984

    When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be called directly, allowing any authenticated non-member to enumerate the team's internal resources and their identifiers. This does not grant access to the contents of the discovered resources themselves, only their existence, names, and identifiers.

    Published:Oct 27, 2026
    Last Modified:Oct 27, 2026
    EPS:Oct 27, 2026
    EPSS Score:
    CVSS Score:4.3

    Affected Products

    Vendor
    Nextcloud
    Product
    Server

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-284 Improper Access Control

    Related CVEs

    CVE-2026-77172 (CVSS 5.3) — App passwords were allowed to bypass password confirmation on sensitive endpoints.…
    CVE-2026-77167 (CVSS 7.5) — Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database…
    CVE-2026-77165 (CVSS 6.5) — File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked wit…
    CVE-2026-68493 (CVSS 3.1) — After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of me…
    CVE-2026-77164 (CVSS 6.2) — Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the re…
    CVE-2026-82985 (CVSS 6.5) — The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSo…
    CVE-2025-64011 (CVSS 4.3) — Nextcloud Server 30.0.0 is vulnerable to an Insecure Direct Object Reference (IDOR) in the /core/preview endpo…
    CVE-2025-66552 (CVSS 4.3) — Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 30…
    CVE-2025-66547 (CVSS 4.3) — Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 31…
    CVE-2025-66512 (CVSS 5.4) — Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High