CVE-2026-77170

Nextcloud / Deck PUBLISHED

Description (CNA)

The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has permission to manage the referenced board.

Affected (CNA)

Vendor / product	Versions
Nextcloud / Deck	affected 1.16.0 through 1.18.0

CWE

CWE-284

References

https://hackerone.com/reports/3599383

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.