CVE-2024-37882: Nextcloud Server can reshare read&share only folder with more permissions
Nextcloud Server is a self hosted personal cloud system. A recipient of a share with read&share permissions could reshare the item with more permissions. It is recommended that the Nextcloud Server is upgraded to 26.0.13 or 27.1.8 or 28.0.4 and that the Nextcloud Enterprise Server is upgraded to 26.0.13 or 27.1.8 or 28.0.4.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-37882?
CVE-2024-37882 is classified as a medium severity vulnerability.
How do I fix CVE-2024-37882?
To fix CVE-2024-37882, upgrade your Nextcloud Server to version 26.0.13, 27.1.8, or 28.0.4.
Who is affected by CVE-2024-37882?
CVE-2024-37882 affects owners of Nextcloud Server versions prior to 26.0.13, 27.1.8, and 28.0.4.
What does CVE-2024-37882 allow an attacker to do?
CVE-2024-37882 allows a recipient of a shared item to reshare it with elevated permissions.
Is there any workaround for CVE-2024-37882?
There are no specific workarounds for CVE-2024-37882, so upgrading is strongly recommended.