Improper privilege management in Nextcloud Enterprise Server and Nextcloud Server - CVE-2024-52516

Vulnerability details

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to shares are not removed when user is limited to share with in their groups and being removed from one of them. A remote user can gain access to sensitive information on the system.

Affected software

How to mitigate CVE-2024-52516

External References

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-35gc-jc6x-29cm
• https://github.com/nextcloud/server/pull/47180
• https://github.com/nextcloud/server/commit/142b6e313ffa9d3b950bcd23cb58850d3ae7cf34

Related Security Bulletins

• Improper privilege management in Nextcloud Server and Enterprise Server