CVE-2026-77170 Overview
CVE-2026-77170 is a broken access control vulnerability [CWE-284] in the Nextcloud Deck config API. The API accepts board-scoped configuration writes for any board ID without verifying that the authenticated user owns or has management rights over the target board. Any authenticated user can therefore modify configuration keys associated with boards belonging to other users.
Critical Impact
An authenticated attacker can tamper with configuration values on boards they do not own, resulting in limited integrity loss across the Deck application.
Affected Products
- Nextcloud Deck application (specific fixed version not published in the NVD record)
- Deployments exposing the Deck config API to authenticated users
- Multi-tenant Nextcloud environments where users share a Deck instance
Discovery Timeline
- 2026-09-18 - CVE-2026-77170 published to the National Vulnerability Database
- 2026-09-18 - Last updated in NVD database
Technical Details for CVE-2026-77170
Vulnerability Analysis
The Deck config API exposes endpoints that persist board-scoped configuration keys keyed by a board identifier supplied in the request. The handler authenticates the caller but omits an authorization check tying the caller to the referenced board. As a result, a low-privilege authenticated user can submit configuration writes referencing arbitrary board IDs.
The issue is limited to integrity of configuration state. Confidentiality and availability are not directly affected according to the published metrics. Exploitation requires only valid credentials on the Nextcloud instance and network access to the Deck API.
This class of flaw is tracked as broken access control [CWE-284]. It stems from missing object-level authorization on state-changing API calls, a common pattern in collaborative applications that separate authentication from per-resource permission checks.
Root Cause
The root cause is a missing ownership or permission check within the Deck config API handler. The controller trusts the boardId parameter supplied by the client and writes configuration values without consulting the board access control list. No validation confirms that the authenticated principal has the MANAGE or owner role for the referenced board.
Attack Vector
Exploitation is network-based and requires an authenticated session on a Nextcloud instance running the Deck app. An attacker issues an HTTP request to the Deck config endpoint with a boardId corresponding to a board they do not own, together with the configuration key and value they wish to set. The server persists the change without further validation. No user interaction is required from the legitimate board owner.
See the HackerOne Security Report #3599383 for technical details of the reported behavior.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-77170
Indicators of Compromise
- Deck config API requests where the authenticated user identifier does not match any owner or manager entry for the referenced boardId
- Unexpected changes to board configuration values that were not initiated by the board owner
- Audit log entries showing configuration writes from user accounts with no prior interaction history for the targeted board
Detection Strategies
- Correlate Nextcloud application logs with Deck board membership tables to flag config writes from non-member accounts
- Alert on high-frequency configuration writes from a single account targeting multiple distinct board IDs
- Baseline normal config API usage per user and surface deviations, particularly writes touching boards outside the user's typical scope
Monitoring Recommendations
- Forward Nextcloud web server and application logs to a centralized analytics platform for cross-user correlation
- Retain Deck API request bodies containing boardId and configuration key names to enable retrospective hunts
- Monitor account behavior for accounts issuing configuration writes shortly after authentication with no other Deck activity
How to Mitigate CVE-2026-77170
Immediate Actions Required
- Upgrade the Nextcloud Deck app to the latest available release once a fixed version is published by the maintainers
- Review recent Deck audit logs for unauthorized board configuration changes and restore expected values where needed
- Restrict Deck API access to trusted authenticated user populations pending patch deployment
Patch Information
The NVD entry does not list a specific fixed version at the time of publication. Administrators should monitor the Nextcloud Deck project release notes and the referenced HackerOne Security Report #3599383 for the corresponding patch and upgrade to the fixed release when available.
Workarounds
- Limit Deck app availability to a smaller trusted user group using Nextcloud group restrictions until a patched version is deployed
- Enforce stricter provisioning controls so that only vetted accounts can authenticate to the Nextcloud instance
- Periodically export and diff board configuration state to detect unauthorized modifications early
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
