CVE-2026-77166
5Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 2.4
exploitation probability
—
observed exploitation
nono source reports it
The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items.
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
Affected products
Nextcloud · CollectivesReferences
https://hackerone.com/reports/3599470