Listen to this Post
How the Mentioned CVE Works
The vulnerability exists in the permission logic of Nextcloud Deck. Users who have been granted the “Can share” permission on a specific board are authorized to invite new members. The flawed logic fails to properly validate subsequent permission modification requests. When a user with share access attempts to change the permissions (e.g., from “Can edit” to “Can share”) of another existing board recipient, the application does not check if the requesting user has the authority to modify existing member permissions. This allows a user to elevate the privileges of other participants beyond their intended scope, potentially granting them “Can share” or admin-like access they should not possess, leading to a lateral or vertical privilege escalation within the affected board.
Platform: Nextcloud Deck
Version: <1.14.6, <1.15.2
Vulnerability: Permission Escalation
Severity: Medium
Date: 2025-12-05
Prediction: Patch 2025-12-02
What Undercode Say:
Check installed Deck app version
occ app:getpath deck
Sample vulnerable API request logic
curl -X PUT 'https://nc-instance/ocs/v2.php/apps/deck/api/v1.0/boards/{boardId}/permissions/{userId}' \
-H "OCS-APIRequest: true" -H "Authorization: Bearer $TOKEN" \
-d '{"permission": 31}' 31 may represent all permissions
Verify patch via commit hash
git -C /nextcloud/apps/deck log --oneline -1
How Exploit:
Attacker with “Can share” permission on a board sends a crafted request to modify the permission level of another board member, elevating them to “Can share” or owner status, thereby propagating unauthorized access.
Protection from this CVE
Update to Deck version 1.14.6 or 1.15.2. Implement strict server-side validation for all permission modification operations, ensuring the requester’s privilege level is re-evaluated against the target’s current permissions.
Impact:
Unauthorized permission modification, data integrity loss, internal privilege escalation within project boards.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
