Read-only users can restore old versions
Package
Server
(Nextcloud)
Affected versions
>= 26.0.0, >= 27.0.0, >= 28.0.0
Patched versions
26.0.12, 27.1.7, 28.0.3
Server
(Nextcloud Enterprise)
>= 23.0.0, >= 24.0.0, >= 25.0.0, >= 26.0.0, >= 27.0.0, >= 28.0.0
23.0.12.16, 24.0.12.12, 25.0.13.6, 26.0.12, 27.1.7, 28.0.3
Description
Credits
-
7h3b4dger Finder
Impact
An attacker with read-only access to a file is able to restore older versions of a document when the files_versions app is enabled.
Patches
It is recommended that the Nextcloud Server is upgraded to 26.0.12, 27.1.7 or 28.0.3
It is recommended that the Nextcloud Enterprise Server is upgraded to 23.0.12.16, 24.0.12.12, 25.0.13.6, 26.0.12, 27.1.7 or 28.0.3
Workarounds
References
For more information
If you have any questions or comments about this advisory: