CVE-2024-52516

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 22.2.11 Nextcloud Server versions prior to 23.0.11 Nextcloud Server versions prior to 24.0.6 Nextcloud Enterprise Server versions prior to 22.2.11 Nextcloud Enterprise Server versions prior to 23.0.11 Nextcloud Enterprise Server versions prior to 24.0.6

Description: The issue is related to insecure management of privileges in Nextcloud Server and Nextcloud Enterprise Server. This can allow a remote attacker to disclose protected information. When a server is configured to only allow sharing with users that are in one's own groups, after a user was removed from a group, previously shared items were not unshared.

Recommendations: For Nextcloud Server versions prior to 22.2.11, upgrade to version 22.2.11 or later. For Nextcloud Server versions prior to 23.0.11, upgrade to version 23.0.11 or later. For Nextcloud Server versions prior to 24.0.6, upgrade to version 24.0.6 or later. For Nextcloud Enterprise Server versions prior to 22.2.11, upgrade to version 22.2.11 or later. For Nextcloud Enterprise Server versions prior to 23.0.11, upgrade to version 23.0.11 or later. For Nextcloud Enterprise Server versions prior to 24.0.6, upgrade to version 24.0.6 or later.