Description
A logic error in Nextcloud Server 19.0.0 caused a privilege escalation allowing malicious users to reshare with higher permissions than they got assigned themselves.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Nextcloud Server | Fixed in 19.0.1 | — |
References
- https://hackerone.com/reports/889243
- https://nextcloud.com/security/advisory/?id=NC-SA-2020-029
- FEDORA-2020-c9863904de vendor-advisory
- FEDORA-2020-050aaa14f7 vendor-advisory