4.6Medium
Nextcloud Tables
The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission.
nextcloud tables vulnerabilities (CVE)
CVE records published for nextcloud tables, newest first. Follow to get an email when a new one appears.
3.3Low
Nextcloud Tables
The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level permission on the table before returning the full list of share recipients (users, groups, and teams) along with their pe…
7.1High
Nextcloud: Tables app allows limited SQLi in ORDER BY with malicious sort order argument for Table Views
nextcloud security-advisories
Nextcloud is an open source content collaboration platform. From versions 0.9.0 to before 0.9.7, and 1.0.0 to before 1.0.2, a missing sanitization in the Tables app allowed a user with access to the tables app to perform a limited SQL injection in the ORDER B…
8.2High
Nextcloud: SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution
nextcloud security-advisories
Nextcloud is an open source content collaboration platform. From versions 0.7.0 to before 0.7.7, 0.8.0 to before 0.8.10, 0.9.0 to before 0.9.8, and 1.0.0 to before 1.0.4, an authenticated attacker with access to the Tables app may be able to execute arbitrary…
4.3Medium
Nextcloud: Information Disclosure of view filter metdata via Broken Sensitive Data Masking in ViewService
nextcloud security-advisories
Nextcloud is an open source content collaboration platform. From version 0.8.0 to before version 1.0.4, the view filter criteria is exposed to users with read-only permissions in Nextcloud Tables. This issue has been patched in versions 1.0.4 and 2.0.0.
4.3Medium
Nextcloud Tables app allowed users to view columns metadata information of any table
nextcloud security-advisories
Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.7 and 0.9.4, authenticated users were able to view meta data of columns in other tables of the Tables app by modifying the numeric ID in a request. This vulnerability …
6.3Medium
Nextcloud Tables is missing an ownership check which allows moving columns into tables of other users
nextcloud security-advisories
Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.6 and 0.9.3, a malicious user was able to create their own table and then move a column to a victims table. This vulnerability is fixed in 0.8.6 and 0.9.3.
4.3Medium
Nextcloud Tables app share information not limited to relevant users
nextcloud security-advisories
Nextcloud Tables allows you to create your own tables with individual columns. Prior to 0.8.9, 0.9.6, and 1.0.1, the information which table (numeric ID) is shared with which groups or users and the respective permissions was not limited to privileged users. …