CVE-2016-9464: Medium severity nextcloud server vulnerability
Nextcloud Server before 9.0.54 and 10.0.0 suffers from an improper authorization check on removing shares. The Sharing Backend as implemented in Nextcloud does differentiate between shares to users and groups. In case of a received group share, users should be able to unshare the file to themselves but not to the whole group. The previous API implementation simply unshared the file to all users in the group.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9464?
CVE-2016-9464 has been rated as a medium severity vulnerability affecting Nextcloud Server.
How do I fix CVE-2016-9464?
To fix CVE-2016-9464, upgrade to Nextcloud Server version 9.0.54 or later, or 10.0.0 or later.
What vulnerabilities does CVE-2016-9464 introduce?
CVE-2016-9464 introduces improper authorization issues that allow users to unshare files from group shares.
Which versions of Nextcloud Server are affected by CVE-2016-9464?
CVE-2016-9464 affects Nextcloud Server versions prior to 9.0.54 and version 10.0-rc1.
What is the impact of exploiting CVE-2016-9464?
Exploiting CVE-2016-9464 can allow unauthorized users to remove shared files from their own access.