🎯 New Report #3674940: Critical broken access control: API-only delegated admin can enumerate all Team Folders and grant access to arbitrary groups
🔺Severity: Medium
👽 Reporter: qloo
⭐️ Reputation: 288
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: null
🕐 Submitted: 2026-04-15
⏰ Disclosed: 2026-09-17 10:41:04
📝 Summary: A critical broken access control vulnerability was discovered in Nextcloud's Group Folders app. The vulnerability allowed an API/REST only delegated admin to bypass folder-level authorization and gain access to any Team Folder by abusing the POST /index.php/apps/groupfolders/folders/{id}/groups endpoint. This was possible because the folder IDs were predictable, allowing the attacker to enumerate all Team Folders and mass-assign their own group, resulting in full access to organization-wide data.
📂 Report JSON File: 3674940
@hackeronereports