Vulnerability · Published Sep 18, 2026 · Assigned by hackerone
CVE-2026-77169
Medium 6.5
In plain English
A medium-severity improper access control in Team Folders from Nextcloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).
Official description
A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed API/REST-only delegated administrators to bypass folder-level authorization controls. The workspace app enables organizations to delegate limited administrative privileges for team folder management via API/REST only, restricting access to folders for which the admin has advanced permissions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Nextcloud | Team Folders | 13.0.0 – before 22.0.0 |
Weakness: CWE-284 · Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N