Server

When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be called directly, allowing any authenticated non-member to enumerate the team's internal resources and their identifiers. This does not grant access to the contents of the discovered resources themselves, only their existence, names, and identifiers.

Published: 2026-10-27T16:15:34.831Z
Updated: 2026-11-04T20:25:03.302Z

Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely — there is no automatic cleanup mechanism. Three distinct denial-of-service conditions follow from this write primitive, all triggered from the same unauthenticated source and all self-renewing on a 24-hour cycle for as long as the injected rows remain in the database.

Published: 2026-10-27T16:15:34.778Z
Updated: 2026-11-04T20:25:10.944Z

App passwords were allowed to bypass password confirmation on sensitive endpoints.

Published: 2026-10-27T16:15:34.765Z
Updated: 2026-11-04T17:58:26.808Z

After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of.

Published: 2026-09-18T01:26:04.654Z
Updated: 2026-09-18T19:40:16.781Z

The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewing the album, rather than the album owner's configuration. When an album owner shares a smart album with another user, that user's own folder configuration is used to determine which of the owner's files are searched — allowing them to discover files (name, file ID, and other metadata) in folders the album owner never intended to include in the shared album. This requires the album owner to have shared a filter-based smart album with the attacker; it does not allow access to arbitrary users' files without such a share.

Published: 2026-09-18T01:26:04.650Z
Updated: 2026-09-18T19:40:43.484Z