CVE-2026-82985: Nextcloud Photos Smart Albums Disclosure

CVE-2026-82985 Overview

CVE-2026-82985 is an improper access control vulnerability [CWE-284] affecting the Photos app's filter-based smart albums. The flaw stems from the application building shared album file listings using the search configuration (photosSourceFolders) of the viewing user rather than the album owner's configuration. When an owner shares a filter-based smart album, the recipient's own folder scope determines which of the owner's files are enumerated. This allows the recipient to discover file names, file IDs, and metadata in folders the owner never intended to expose.

Critical Impact
Recipients of a shared filter-based smart album can enumerate metadata from the album owner's files stored in folders outside the intended album scope.

Affected Products

Photos application implementing filter-based smart albums
Deployments where users share smart albums across accounts
Configurations relying on photosSourceFolders for scoping

Discovery Timeline

2026-09-18 - CVE-2026-82985 published to NVD
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-82985

Vulnerability Analysis

The Photos app implements smart albums that dynamically generate a file listing based on filter criteria applied against a configured set of source folders. The listing generation logic reads photosSourceFolders from the currently authenticated user's session rather than from the album owner's stored configuration.

When a user shares a filter-based smart album with a second user, the server evaluates the filter against the owner's files but scopes the search using the recipient's folder settings. Because the recipient controls their own photosSourceFolders, they can broaden the scope to include folder paths that exist in the owner's storage but were never approved for sharing.

The exposure is limited to metadata such as file names, file identifiers, and associated attributes returned by the search. It does not grant arbitrary access to unrelated users' files, since the recipient must first receive a smart album share from the owner.

Root Cause

The root cause is a broken access control pattern in which the server trusts the requesting user's configuration to define the search boundary for another user's data. The album owner's photosSourceFolders should authoritatively constrain the file enumeration, but the code path substitutes the viewer's configuration during listing generation.

Attack Vector

Exploitation requires the attacker to hold a valid account and to be the recipient of a filter-based smart album share from the target owner. The attacker modifies their own photosSourceFolders to include folder paths they suspect exist in the owner's storage. Requesting the shared smart album then returns metadata for matching files in those folders, regardless of the owner's original intent.

The vulnerability manifests in the smart album listing generation logic. See the HackerOne Report #3506873 for full technical details.

Detection Methods for CVE-2026-82985

Indicators of Compromise

Unusual modifications to photosSourceFolders configuration by users who are recipients of shared smart albums.
Smart album listing responses that return file identifiers or paths outside the album owner's declared source folders.
Access logs showing repeated smart album queries from a single recipient following configuration changes.

Detection Strategies

Audit application logs for smart album API calls correlated with recent changes to a recipient's folder configuration.
Compare returned file metadata against the album owner's documented photosSourceFolders scope to identify boundary violations.
Alert on cross-user access patterns where a share recipient enumerates file IDs in owner directories that are not part of the shared album definition.

Monitoring Recommendations

Enable verbose logging on the Photos app's search and album endpoints to capture folder scope resolution.
Monitor for accounts that modify search configuration shortly before requesting shared smart albums.
Review sharing telemetry weekly to identify smart albums with unexpected recipient enumeration volume.

How to Mitigate CVE-2026-82985

Immediate Actions Required

Identify users who have shared filter-based smart albums and review recipient activity for anomalous enumeration.
Temporarily disable filter-based smart album sharing until the vendor patch is applied.
Notify album owners that shared smart albums may have exposed metadata beyond their intended scope.

Patch Information

Refer to the HackerOne Report #3506873 for vendor remediation status. Apply vendor-provided updates that enforce the album owner's photosSourceFolders configuration when generating shared smart album listings.

Workarounds

Restrict use of filter-based smart albums to single-user contexts until patched.
Convert sensitive smart albums to static albums with explicit file selections that do not rely on folder-based filters.
Segregate sensitive files into storage accounts that are never used as sources for shared smart albums.

bash

# Configuration example: audit smart album shares and recipient folder scopes
# Review current shares and flag filter-based smart albums for manual verification
grep -R "smartAlbum" /var/log/photos/ | grep "share"