CVE-2020-8139

Name of the Vulnerable Software and Affected Versions Nextcloud Server versions prior to 18.0.1 Nextcloud Server versions prior to 17.0.4 Nextcloud Server versions prior to 16.0.9

Description A missing access control check in the software causes hide-download shares to be downloadable when appending /download to the URL. This issue allows unauthorized access to shared files.

Recommendations For versions prior to 18.0.1, update to version 18.0.1 or later to resolve the issue. For versions prior to 17.0.4, update to version 17.0.4 or later to resolve the issue. For versions prior to 16.0.9, update to version 16.0.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the /download endpoint until a patch is available.