Balvant Chavda

**Name of the Vulnerable Software and Affected Versions** Nextcloud (affected versions not specified) **Description** Remote-instance signature verification in Circles fetches the `keyId` URL provided by an attacker before trust is established. This process explicitly allows local or private addresses, bypassing core Server-Side Request Forgery (SSRF) protections. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. The public, unauthenticated endpoints 'POST /apps/circles/event/' and 'POST /apps/circles/incoming/' reach this code path, enabling any unauthenticated user to force the server to issue a GET request to an internal address. This is a blind SSRF, meaning the response body is not returned to the requester, but an attacker can still determine if an internal service is reachable. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Nextcloud (affected versions not specified) **Description** An improper authorization issue exists in the DAV plugin where the system resolves files from the absolute request URI without verifying if the path segment matches the authenticated session user. This allows any authenticated user to lock or unlock files belonging to other users by targeting absolute WebDAV paths. This flaw can lead to cross-user manual locks, which block write operations such as PUT, MOVE, DELETE, and editor saves, as well as lock-token disclosure, allowing unauthorized users to remove token-based client locks of other users. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.