Input Validation Vulnerability in Emoji Update Feature by Affected Vendor
CVE-2026-77166

2.4LOW

Key Information:

Vendor

Nextcloud
Status
Collectives
Vendor
CVE Published:
21 September 2026

What is CVE-2026-77166?

The emoji update feature is susceptible to an input validation vulnerability that fails to properly sanitize user inputs in the emoji field. An attacker can exploit this flaw by injecting excessively long text and line breaks, which leads to a disruption in the sidebar layout. Consequently, important elements may become hidden or misaligned, affecting overall user experience and interface usability.

Affected Version(s)

Collectives 3.2.1 <= 3.5.0

References

https://hackerone.com/reports/3599470

CVSS V3.0

Score:
2.4
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

_dha (yoyomiski)
.