CVE-2024-37882: Nextcloud Server Auth Bypass Vulnerability

CVE-2024-37882 Overview

Nextcloud Server contains a broken access control vulnerability that allows the recipient of a shared item to reshare it with higher permissions than originally granted. A user given read and share permissions on a file or folder could reshare that item with additional permissions such as write or delete. The flaw affects both Nextcloud Server and Nextcloud Enterprise Server across the 26.x, 27.x, and 28.x release branches. Nextcloud published fixes in versions 26.0.13, 27.1.8, and 28.0.4. The vulnerability is tracked under [CWE-284] Improper Access Control and [CWE-281] Improper Preservation of Permissions.

Critical Impact
Authenticated users with limited share permissions can escalate access on shared resources, exposing sensitive data to unauthorized modification or redistribution.

Affected Products

Nextcloud Server versions prior to 26.0.13
Nextcloud Server versions 27.x prior to 27.1.8 and 28.x prior to 28.0.4
Nextcloud Enterprise Server versions prior to 26.0.13, 27.1.8, and 28.0.4

Discovery Timeline

2024-06-14 - CVE-2024-37882 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-37882

Vulnerability Analysis

The vulnerability resides in the Nextcloud sharing subsystem, where permission checks fail to enforce the upper bound of a reshare against the permissions of the original share. When a user receives a share with read and share rights, the server permits that user to create a downstream share with any permission bitmask. This effectively lets a downstream recipient obtain rights the sharing user does not possess, such as update or delete.

The issue is a business logic flaw in the resharing workflow rather than a memory-safety defect. It requires an authenticated account with an existing share and network access to the Nextcloud web interface or WebDAV endpoint. Successful exploitation impacts confidentiality and integrity of shared content but does not directly disrupt server availability.

Root Cause

The reshare handler did not intersect the requested permission mask with the permissions held by the resharing user. The pull request nextcloud/server#44339 introduces additional checks so that a reshare cannot exceed the source share's granted rights. The GitHub Security Advisory GHSA-jjm3-j9xh-5xmq documents the corrective changes.

Attack Vector

An attacker must hold a valid account on the target Nextcloud instance and be the recipient of at least one share carrying the share permission. The attacker then reshares the item, specifying a permission set greater than what they were granted. Downstream users, including collaborators controlled by the attacker, receive the elevated rights. See HackerOne Report #2289425 for the coordinated disclosure record.

No verified proof-of-concept code is publicly available. The vulnerability is exercised through normal share API calls with a manipulated permissions parameter and does not require custom tooling.

Detection Methods for CVE-2024-37882

Indicators of Compromise

Audit log entries showing reshare events where the child share carries higher permission bits than the parent share for the same file identifier.
Unexpected write, delete, or reshare activity on files by users who were originally granted read-only or share-only access.
Access to oc_share table rows where permissions on a reshare exceeds permissions of the referenced parent share.

Detection Strategies

Query the Nextcloud database for share rows where parent is not null and the child's permissions value is greater than the parent's, indicating a policy violation.
Correlate WebDAV PROPPATCH, PUT, and DELETE operations against the effective permissions the acting user should have on the resource.
Baseline normal sharing behavior per user and alert on sudden creation of shares with elevated permission masks.

Monitoring Recommendations

Enable and centralize Nextcloud admin_audit logs, forwarding share creation and modification events to a SIEM for retention and analysis.
Monitor authentication and share API endpoints for anomalous volumes of OCS Share API requests from a single account.
Track version and patch state of all Nextcloud Server and Enterprise Server nodes to confirm remediation coverage.

How to Mitigate CVE-2024-37882

Immediate Actions Required

Upgrade Nextcloud Server or Nextcloud Enterprise Server to 26.0.13, 27.1.8, or 28.0.4 on all instances.
Review existing reshares created before patching and revoke any that grant permissions exceeding the parent share.
Rotate credentials for accounts that show anomalous reshare activity in audit logs.

Patch Information

Nextcloud released fixed packages in versions 26.0.13, 27.1.8, and 28.0.4 for both Server and Enterprise Server. The corrective code is available in pull request #44339, and remediation details are documented in the GitHub Security Advisory GHSA-jjm3-j9xh-5xmq.

Workarounds

Restrict use of the share permission on sensitive files and folders until patching is complete, granting only direct shares from privileged accounts.
Disable federated and public resharing through the administrative sharing settings to limit propagation of elevated permissions.
Enforce group-based sharing policies that prevent downstream reshare by default for regular users.

bash

# Example: verify installed Nextcloud version and upgrade via occ
sudo -u www-data php /var/www/nextcloud/occ status
sudo -u www-data php /var/www/nextcloud/occ upgrade

# Restrict resharing via config.php for defense-in-depth
# 'sharing.allowCustomTokens' => false,
# 'share_folder' => '/Shared',