Exposure of Sensitive Metadata in Photo Management App by Specific Vendor
CVE-2026-82985

6.5MEDIUM

Key Information:

Vendor

Nextcloud
Status
Server
Vendor
CVE Published:
18 September 2026

What is CVE-2026-82985?

The Photos app features a filtering mechanism for smart albums that improperly utilizes the viewing user's folder configuration instead of the album owner's settings. As a result, when an album owner shares a smart album, the recipient can inadvertently access metadata about files from folders that were not intended to be shared. This vulnerability occurs only when a smart album is explicitly shared, underlining the necessity for careful management of shared album permissions to prevent unintended data exposure.

Affected Version(s)

Server 32.0.0

References

https://hackerone.com/reports/3506873

CVSS V3.0

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Joseph Semaan (suul)
.