Authorization Flaw in 3D Viewer for Nextcloud Exposes Protected Files

CVE-2026-104189

What is CVE-2026-104189?

The 3D Viewer for Nextcloud, a 3D model viewing application, had a critical authorization flaw that allowed users with knowledge of a share token to access sensitive files without the required password. Versions 1.7.9 through 3.3.1 failed to enforce proper share authorization on public file endpoints, resulting in unauthorized access to files even when they were password-protected. The flaw stemmed from the lack of checks on specific controller routes, enabling responses that included file contents rather than prompts for password input. This vulnerability primarily affected 3D file formats, such as STL, GLB/glTF, OBJ, STEP, and IFC, but left other non-3D files unaffected. It is recommended that users upgrade to version 3.3.2 or disable the 3D Viewer app to mitigate the risk of unauthorized access.

References