Nextcloud Server users can modify tags on files that do not belong to them
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.3epss 0.3%
exploitation probability
0.3%top 81% of all CVEs
observed exploitation
nono source reports it
Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 31.0.1, non-privileged users can modify tags on files they should not have access to via bulk tagging. This vulnerability is fixed in 31.0.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected products
nextcloud · security-advisoriesReferences
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-hq6c-r898-fgf2https://github.com/nextcloud/server/commit/b44f1568f2dc97c746281d99e2342ad679e3d8a9https://github.com/nextcloud/server/issues/51247https://github.com/nextcloud/server/pull/51288https://hackerone.com/reports/3040887