Improper access control in Nextcloud Enterprise Server and Nextcloud Server - CVE-2024-52514

Vulnerability details

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote user can copy folder that contain files that are blocked by the files access control.

Affected software

How to mitigate CVE-2024-52514

External References

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-g8pr-g25r-58xj
• https://github.com/nextcloud/server/pull/44889
• https://github.com/nextcloud/server/commit/5fffbcfe8650eab75b00e8d188fbc95b0e43f3a8
• https://hackerone.com/reports/2447316

Related Security Bulletins

• Improper access control in Nextcloud Server and Enterprise Server