Auth Bypass: Enumerate Team Resources via API Even When Team Visible to Everyone
CVE-2026-82984 Published on October 27, 2026
When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be called directly, allowing any authenticated non-member to enumerate the team's internal resources and their identifiers. This does not grant access to the contents of the discovered resources themselves, only their existence, names, and identifiers.
Weakness Type
What is an Authorization Vulnerability?
The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVE-2026-82984 has been classified to as an Authorization vulnerability or weakness.
Products Associated with CVE-2026-82984
Want to know whenever a new CVE is published for Nextcloud Server? stack.watch will email you.
Affected Versions
Nextcloud Server:- Version 32.0.0, <= 33.0.0 is affected.