CVE-2023-39952
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
Nextcloud Server allows users to access files in a subfolder of a groupfolder, even if advanced permissions should block this access. This issue affects versions from 22.0.0 to 22.2.10.13, 23.0.12.8, 24.0.12.4, 25.0.8, 26.0.3, and 27.0.1.
Risk Assessment
Organizations may be exposed to unauthorized access to sensitive data, potentially leading to privacy breaches and information security issues.
Recommendation
It is recommended to upgrade to Nextcloud Server versions that include patches to secure access to files in group folders.
Original NVD description (English source)
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 22.0.0 and prior to versions 22.2.10.13, 23.0.12.8, 24.0.12.4, 25.0.8, 26.0.3, and 27.0.1, a user can access files inside a subfolder of a groupfolder accessible to them, even if advanced permissions would block access to the subfolder. Nextcloud Server versions 25.0.8, 26.0.3, and 27.0.1 and Nextcloud Enterprise Server versions 22.2.10.13, 23.0.12.8, 24.0.12.4, 25.0.8, 26.0.3, and 27.0.1 contain a patch for this issue. No known workarounds are available.