CVE-2018-16466

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Improper revalidation of permissions in Nextcloud Server prior to 14.0.0, 13.0.6 and 12.0.11 lead to not accepting access restrictions by acess tokens.

Metrics

CVSS 3.0 8.1/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-284 CWE-273

Affected software

Vendor	Product	Versions
n/a	Nextcloud Server	<14.0.0, <13.0.6, <12.0.11

References

https://hackerone.com/reports/388515Third Party Advisory
https://nextcloud.com/security/advisory/?id=NC-SA-2018-010Vendor Advisory
https://hackerone.com/reports/388515Third Party Advisory
https://nextcloud.com/security/advisory/?id=NC-SA-2018-010Vendor Advisory

Timeline

Published: Oct 30, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-164675.3A missing check in Nextcloud Server prior to 14.0.0 could give unauthorized access to the previews of single file password protected shares.CVE-2018-164685.4In the Loofah gem for Ruby, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.CVE-2018-164697.5The merge.recursive function in the merge package <1.2.1 can be tricked into adding or modifying properties of the Object prototype. These p CVE-2018-16477.5IBM QRadar Incident Forensics 7.2 and 7.3 does not properly restrict the size or amount of resources requested which could allow an unauthen CVE-2018-164707.5There is a possible DoS vulnerability in the multipart parser in Rack before 2.0.6. Specially crafted requests can cause the multipart parse CVE-2018-164716.1There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the `schem CVE-2018-164727.5A prototype pollution attack in cached-path-relative versions <=1.0.1 allows an attacker to inject properties on Object.prototype which are CVE-2018-164735.3A path traversal in takeapeek module versions <=0.2.2 allows an attacker to list directory and files.CVE-2018-164746.1A stored xss in tianma-static module versions <=1.0.4 allows an attacker to execute arbitrary javascript.CVE-2018-164757.5A Path Traversal in Knightjs versions <= 0.0.1 allows an attacker to read content of arbitrary files on a remote server.CVE-2018-164767.5A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to d CVE-2018-164776.5A bypass vulnerability in Active Storage >= 5.2.0 for Google Cloud Storage and Disk services allow an attacker to modify the `content-dispos