27th June 2019
Risk level: Medium
CVSS v3 Base Score: 6.4 (AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H)
CWE: Improper Preservation of Permissions (CWE-281)
HackerOne report: 619484
Improper permissions preservation in Nextcloud Server 16.0.1 causes sharees to be able to reshare with write permissions when sharing the mount point of a share they received, as a public link.
The error has been fixed.
It is recommended that the Nextcloud Server is upgraded to 16.0.2.
The Nextcloud team thanks the following people for their research and responsible disclosure of the above advisory: