🎯 New Report #3599383: Arbitrary Board Preference Injection via Deck Config API
🔺Severity: Medium
👽 Reporter: vidang04
⭐️ Reputation: 593
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: null
🕐 Submitted: 2026-03-12
⏰ Disclosed: 2026-09-17 10:20:08
📝 Summary: A vulnerability was discovered in the Deck Config API of the Nextcloud application that allowed authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating the user's ownership or permission to manage the referenced board.
📂 Report JSON File: 3599383
@hackeronereports