Scope of workflow operations is not validated in nextcloud server

Nextcloud Server failed to properly check user permissions for workflow creation, allowing regular users to create admin-only workflows that could execute arbitrary code on the server. This is a serious security flaw because attackers can run commands directly on the server through workflows designed to handle PDFs or scripts.

CWE-78 (Improper Neutralization of Special Elements used in an OS Command) via missing scope validation in workflow operations. Unauthenticated or low-privileged users can create workflows restricted to administrators, potentially triggering RCE through workflow_scripts or workflow_pdf_converter apps that invoke external scripts or webhooks. Impact ranges from information disclosure to complete server compromise depending on available apps and server configuration.