Vulnerability in Nextcloud Server

[ Description ]Official description

The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewing the album, rather than the album owner's configuration. When an album owner shares a smart album with another user, that user's own folder configuration is used to determine which of the owner's files are searched — allowing them to discover files (name, file ID, and other metadata) in folders the album owner never intended to include in the shared album. This requires the album owner to have shared a filter-based smart album with the attacker; it does not allow access to arbitrary users' files without such a share.

[ Fixes ]Fixes and patches

• Security bulletin: Nextcloud GHSA-f99w-3pm7-v4cvVendor patch or bulletin · CERT-FR · github.com/nextcloud/security-advisories/security/advisories/GHSA-f99w, cited by CERT-FR CERTFR-2026-AVI-1283
• Security bulletin: Nextcloud GHSA-4vpp-fp9q-9g23Vendor patch or bulletin · CERT-FR · github.com/nextcloud/security-advisories/security/advisories/GHSA-4vpp, cited by CERT-FR CERTFR-2026-AVI-1283
• Security bulletin: Nextcloud GHSA-5gv7-hw69-w6pxVendor patch or bulletin · CERT-FR · github.com/nextcloud/security-advisories/security/advisories/GHSA-5gv7, cited by CERT-FR CERTFR-2026-AVI-1283
• Security bulletin: Nextcloud GHSA-9mjh-89xm-hcqwVendor patch or bulletin · CERT-FR · github.com/nextcloud/security-advisories/security/advisories/GHSA-9mjh, cited by CERT-FR CERTFR-2026-AVI-1283
• Security bulletin: Nextcloud GHSA-22w9-gpgv-pcgcVendor patch or bulletin · CERT-FR · github.com/nextcloud/security-advisories/security/advisories/GHSA-22w9, cited by CERT-FR CERTFR-2026-AVI-1283

[ Advisories ]Government CERT advisories

• CERT-FR9 Oct 2026CERTFR-2026-AVI-1283

  Multiple vulnerabilities in Nextcloud products Translated from French

  Multiple vulnerabilities have been discovered in Nextcloud products. Some of them allow an attacker to cause privilege escalation, remote denial of service and a breach of data confidentiality.

  CVE-2026-82985CVE-2026-68493CVE-2026-77169+2 more CVEs
• BSI CERT-Bund8 Oct 2026WID-SEC-2026-3840

  Nextcloud: Multiple vulnerabilities Translated from German

  CVE-2026-77166CVE-2026-77169CVE-2026-68493+2 more CVEs

[ References ]References

• hackerone.com/reports/3506873