CVE-2026-77169 — Nextcloud / Team Folders

CVE-2026-77169

Nextcloud / Team Folders PUBLISHED

Description (CNA)

A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed API/REST-only delegated administrators to bypass folder-level authorization controls. The workspace app enables organizations to delegate limited administrative privileges for team folder management via API/REST only, restricting access to folders for which the admin has advanced permissions.

Affected (CNA)

Vendor / product	Versions
Nextcloud / Team Folders	affected 13.0.0 before 22.0.0

CWE

CWE-284

References

https://hackerone.com/reports/3674940

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.