Description
Nextcloud is an open source content collaboration platform. From version 4.3.0 to before version 5.2.7, a removed collaborator retains unauthorized read access to uploaded respondent files for the affected form. The scope is limited to uploaded files for forms where that user previously had results access. This issue has been patched in version 5.2.7.
Affected products
nextcloud: forms
References3
- github.com/nextcloud/security-advisories/security/advisories/GH… MitigationVendor Advisory
- github.com/nextcloud/forms/pull/3291 Issue TrackingPatch
- hackerone.com/reports/3617352 Permissions Required
Metrics
- CVSS 3.1
-
5.3
MEDIUM
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - EPSS — exploit probability
- 0% percentile: 19 · as of 15 November 2026
- CWE
- CWE-552
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.