🎯 New Report #3484601: Team membership information returned on API level based on ID
🔺Severity: Low
👽 Reporter: milou
⭐️ Reputation: 107
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: 200
🕐 Submitted: 2026-01-02
⏰ Disclosed: 2026-09-17 05:49:15
📝 Summary: A vulnerability was discovered in the Nextcloud Circles app that allowed any authenticated user to access membership information for any circle and user combination, regardless of their authorization. The issue stemmed from a lack of permission checks in the affected service and request classes, as well as the public exposure of the vulnerable functionality through an API endpoint. This vulnerability could have led to the disclosure of sensitive organizational data, including private circle memberships, inheritance relationships, and user identification details.
📂 Report JSON File: 3484601
@hackeronereports