[ CVE-2026-77169 · Published 18 Sep 2026 ]
Vulnerability in Nextcloud Team Folders
CVSS 6.5
EPSS <1%2 agency advisoriesFix available
[ Description ]Official description
A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed API/REST-only delegated administrators to bypass folder-level authorization controls. The workspace app enables organizations to delegate limited administrative privileges for team folder management via API/REST only, restricting access to folders for which the admin has advanced permissions.
[ Fixes ]Fixes and patches
- Security bulletin: Nextcloud GHSA-f99w-3pm7-v4cvVendor patch or bulletin · CERT-FR · github.com/nextcloud/security-advisories/security/advisories/GHSA-f99w, cited by CERT-FR CERTFR-2026-AVI-1283
- Security bulletin: Nextcloud GHSA-4vpp-fp9q-9g23Vendor patch or bulletin · CERT-FR · github.com/nextcloud/security-advisories/security/advisories/GHSA-4vpp, cited by CERT-FR CERTFR-2026-AVI-1283
- Security bulletin: Nextcloud GHSA-5gv7-hw69-w6pxVendor patch or bulletin · CERT-FR · github.com/nextcloud/security-advisories/security/advisories/GHSA-5gv7, cited by CERT-FR CERTFR-2026-AVI-1283
- Security bulletin: Nextcloud GHSA-9mjh-89xm-hcqwVendor patch or bulletin · CERT-FR · github.com/nextcloud/security-advisories/security/advisories/GHSA-9mjh, cited by CERT-FR CERTFR-2026-AVI-1283
- Security bulletin: Nextcloud GHSA-22w9-gpgv-pcgcVendor patch or bulletin · CERT-FR · github.com/nextcloud/security-advisories/security/advisories/GHSA-22w9, cited by CERT-FR CERTFR-2026-AVI-1283
[ Advisories ]Government CERT advisories
-
CERT-FRCERTFR-2026-AVI-1283
Multiple vulnerabilities in Nextcloud products Translated from French
Multiple vulnerabilities have been discovered in Nextcloud products. Some of them allow an attacker to cause privilege escalation, remote denial of service and a breach of data confidentiality.
-
BSI CERT-BundWID-SEC-2026-3840
Nextcloud: Multiple vulnerabilities Translated from German