Resource Enumeration Vulnerability in Team Configuration by [Vendor]
CVE-2026-82984

4.3MEDIUM

Key Information:

Vendor

Nextcloud
Status
Server
Vendor
CVE Published:
27 October 2026

What is CVE-2026-82984?

The resource enumeration vulnerability occurs when a team is set to be visible to all users. While the web interface restricts non-members from viewing the team's details, the resources API endpoint can still be accessed by authenticated non-members. This allows attackers to discover the names and identifiers of internal resources associated with the team. While this does not provide direct access to the content of these resources, it poses a potential risk by revealing sensitive organizational information.

Affected Version(s)

Server 32.0.0 <= 33.0.0

References

https://hackerone.com/reports/3511955

CVSS V3.0

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

_dha (yoyomiski)
.