CVE-2024-52516

Published: Nov 15, 2024Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

Nextcloud Server is a self hosted personal cloud system. When a server is configured to only allow sharing with users that are in ones own groups, after a user was removed from a group, previously shared items were not unshared. It is recommended that the Nextcloud Server is upgraded to 22.2.11 or 23.0.11 or 24.0.6 and Nextcloud Enterprise Server is upgraded to 22.2.11 or 23.0.11 or 24.0.6.

Affected (6)

Products: Nextcloud: Nextcloud Server

Nextcloud

1 product

Nextcloud Server

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Nextcloud Nextcloud Server	From 28.0.0 to 28.0.9
Nextcloud Nextcloud Server	From 29.0.0 to 29.0.5
Nextcloud Nextcloud Server	From 26.0.0 to 26.0.13.9
Nextcloud Nextcloud Server	From 27.0.0 to 27.1.11.9
Nextcloud Nextcloud Server	From 28.0.0 to 28.0.9
Nextcloud Nextcloud Server	From 29.0.0 to 29.0.5

Related CWEs

CWE-269

Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

References (3)

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-35gc-jc6x-29cm

Source: security-advisories@github.com

Vendor Advisory

https://github.com/nextcloud/server/commit/142b6e313ffa9d3b950bcd23cb58850d3ae7cf34

Source: security-advisories@github.com

Patch

https://github.com/nextcloud/server/pull/47180

Source: security-advisories@github.com

Issue Tracking

Timeline

No history available yet.