🎯 New Report #3770482: files lock: a write-share collaborator can place a TYPE TOKEN lock that permanently denies the file owner, survives share revocation and account delet
🔺Severity: Medium
👽 Reporter: rz1027
⭐️ Reputation: 1452
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: null
🕐 Submitted: 2026-05-29
⏰ Disclosed: 2026-09-18 15:36:09
📝 Summary: A vulnerability was discovered in files lock 33.0.4 on Nextcloud 33.0.3 that allowed a user with write-share permissions on a file to place a permanent lock on the file that could not be removed by the file owner or an administrator. The lock was stored in the database and persisted even after the collaborator's account was deleted or recreated. The only way to remove the lock was through direct database access, which was not documented in the application's administrative tools.
📂 Report JSON File: 3770482
@hackeronereports