CVE-2026-77169

mediumpriority · track · 0EPSS 0.005 · 40 %ileDE

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.47% (40th) EPSS

CVSS 6.5 · medium

Is it mine?

20 products

Check your exposure

Who says so?

1 sources

cert_bund

EPSS · scored 2026-10-28

A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed API/REST-only delegated administrators to bypass folder-level authorization controls. The workspace app enables organizations to delegate limited administrative privileges for team folder management via API/REST only, restricting access to folders for which the admin has advanced permissions.

cvss

Technical severity, 0–10. One row per scoring source.

6.5

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.06.5mediumCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Nsecondary · support@hackerone.comexploitability 1.2 · impact 5.2

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-284US

affected products (20)

Products and version ranges known to be affected.

Nextcloud Nextcloud Team Folders <13.1.8all versionscert_bundDE
Nextcloud Nextcloud Team Folders <14.0.12all versionscert_bundDE
Nextcloud Nextcloud Team Folders <15.3.13all versionscert_bundDE
Nextcloud Nextcloud Team Folders <16.0.16all versionscert_bundDE
Nextcloud Nextcloud Team Folders <17.0.16all versionscert_bundDE
Nextcloud Nextcloud Team Folders <18.1.14all versionscert_bundDE
Nextcloud Nextcloud Team Folders <19.1.19all versionscert_bundDE
Nextcloud Nextcloud Team Folders <20.1.15all versionscert_bundDE
Nextcloud Nextcloud Team Folders <21.0.8all versionscert_bundDE
Nextcloud Nextcloud Team Folders <22.0.1all versionscert_bundDE
nextcloud nextcloud≤ Team Folders <22.0.1cert_bundDE
nextcloud nextcloud≤ Team Folders <13.1.8cert_bundDE
nextcloud nextcloud≤ Team Folders <14.0.12cert_bundDE
nextcloud nextcloud≤ Team Folders <15.3.13cert_bundDE
nextcloud nextcloud≤ Team Folders <16.0.16cert_bundDE
nextcloud nextcloud≤ Team Folders <17.0.16cert_bundDE
nextcloud nextcloud≤ Team Folders <18.1.14cert_bundDE
nextcloud nextcloud≤ Team Folders <19.1.19cert_bundDE
nextcloud nextcloud≤ Team Folders <20.1.15cert_bundDE
nextcloud nextcloud≤ Team Folders <21.0.8cert_bundDE

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-3840Nextcloud: Mehrere SchwachstellenDeutsch2026-10-08csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen im Nextcloud Server und verschiedenen Apps ausnutzen, um Informationen offenzulegen, um Sicherheitsmechanismen zu umgehen und um einen Denial of Service herbeizuführen.

sources

Which sources assert this record, and when.

cert_bund NVD CVE.org MITRE

published 2026-09-18modified 2026-09-18

references (1) nvd

External citations — patches, advisories, analysis.

https://hackerone.com/reports/3674940

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan