Nextcloud Groupfolders provides admin-configured folders shared by everyone in a group or team. Prior to 14.0.11, 15.3.12, 16.0.15, 17.0.14, 18.1.8, 19.1.8, and 20.1.2, a user with read-only permission can restore a file from the trash bin. This vulnerability is fixed in 14.0.11, 15.3.12, 16.0.15, 17.0.14, 18.1.8, 19.1.8, and 20.1.2.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/nextcloud/groupfolders/commit/bbe87ebed8da23e9df4db637a76fbc8d36439d58 Patch
- https://github.com/nextcloud/groupfolders/pull/4076 Issue Tracking, Patch
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2vrq-fhmf-c49m Patch, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 4.3 · nextcloudNVD modified 2026-10-15 21:10
Affected (CPE criteria) 1
cpe:2.3:a:nextcloud:group_folders:*:*:*:*:*:*:*:*
References 4
- https://github.com/nextcloud/groupfolders/commit/bbe87ebed8da23e9df4db637a76fbc8d36439d58 Patch
- https://github.com/nextcloud/groupfolders/issues/4041 Issue Tracking
- https://github.com/nextcloud/groupfolders/pull/4076 Issue Tracking, Patch
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2vrq-fhmf-c49m Patch, Vendor Advisory