The groupfolders application for Nextcloud allows sharing a folder with a group of people. In addition, it allows setting "advanced permissions" on subfolders, for example, a user could be granted access to the groupfolder but not specific subfolders. Due to a lacking permission check in affected versions, a user could still access these subfolders by copying the groupfolder to another location. Users unable to upgrade should disable the "groupfolders" application in the admin settings. Reference: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m4wp-r357-4q94 https://github.com/nextcloud/server/pull/29362 https://github.com/nextcloud/groupfolders/issues/1692
Created nextcloud tracking bugs for this issue: Affects: fedora-all [bug 2063896]
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.