🎯 New Report #3617729: Mail contact autocomplete bypasses administrator-configured user enumeration restrictions and expose member information outside the intended scope
🔺Severity: Medium
👽 Reporter: njh215
⭐️ Reputation: 107
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: null
🕐 Submitted: 2026-03-20
⏰ Disclosed: 2026-09-04 20:38:01
📝 Summary: A vulnerability was discovered in the Mail contact autocomplete feature of Nextcloud that allowed an authenticated user to bypass administrator-configured user enumeration restrictions and expose member information outside the intended scope. The vulnerability was present in the ContactIntegrationController::autoComplete() handler, which did not apply the stricter user enumeration controls used elsewhere in the product.
📂 Report JSON File: 3617729
@hackeronereports