CVE-2024-52516CWE-269

Nextcloud Server's shares are not removed when user is limited to share with in their groups and being removed from one of them

Low · published November 15, 2024

CVSS v3.1
3.0
EPSS
0%
Percentile
36.2
In the wild
Unconfirmed
What it is

Nextcloud Server is a self hosted personal cloud system. When a server is configured to only allow sharing with users that are in ones own groups, after a user was removed from a group, previously shared items were not unshared. It is recommended that the Nextcloud Server is upgraded to 22.2.11 or 23.0.11 or 24.0.6 and Nextcloud Enterprise Server is upgraded to 22.2.11 or 23.0.11 or 24.0.6.

The record
Technical detail
CVSS v3.1
3.0 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00430 · 36.2th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2024-11-15T16:55Z
EPSS history
Timeline
  • 15 NOV 16:55Z
    Nextcloud Server's shares are not removed when user is limited to share with in their groups and being removed from one of them
    cvelistv5