CVE-2026-77169

6.5 Moyenne

Publiée le 18/09/2026 à 04:17 · Modifiée le 18/09/2026 à 22:17 · Analyse NVD reportée · Source : support@hackerone.com

Description

A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed API/REST-only delegated administrators to bypass folder-level authorization controls. The workspace app enables organizations to delegate limited administrative privileges for team folder management via API/REST only, restricting access to folders for which the admin has advanced permissions.

Traduire en français

Produits concernés

Nextcloud Team Folders

Scores CVSS

Version	Score	Source	Vecteur
3.0	6.5 Moyenne	support@hackerone.com	`CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N`

Faiblesses (CWE)

CWE-284

Références

https://hackerone.com/reports/3674940

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories