CVE-2020-8182

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

Improper access control in Nextcloud Deck 0.8.0 allowed an attacker to reshare boards shared with them with more permissions than they had themselves.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284 CWE-281

Affected software

Vendor	Product	Versions
n/a	Nextcloud Deck	Fixed in 0.8.1

References

https://hackerone.com/reports/827816Exploit, Third Party Advisory
https://nextcloud.com/security/advisory/?id=NC-SA-2020-025Vendor Advisory
https://hackerone.com/reports/827816Exploit, Third Party Advisory
https://nextcloud.com/security/advisory/?id=NC-SA-2020-025Vendor Advisory

Timeline

Published: Oct 5, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-81837.5A logic error in Nextcloud Server 19.0.0 caused a plaintext storage of the share password when it was given on the initial create API call.CVE-2020-81847.5A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it is possib CVE-2020-81856.5A denial of service vulnerability exists in Rails <6.0.3.2 that allowed an untrusted user to run any pending migrations on a Rails app runni CVE-2020-81869.8A command injection vulnerability in the `devcert` module may lead to remote code execution when users of the module pass untrusted input to CVE-2020-81877.5Improper input validation in Citrix ADC and Citrix Gateway versions before 11.1-63.9 and 12.0-62.10 allows unauthenticated users to perform CVE-2020-81888.8We have recently released new version of UniFi Protect firmware v1.13.3 and v1.14.10 for Unifi Cloud Key Gen2 Plus and UniFi Dream Machine P CVE-2020-81895.4A cross-site scripting error in Nextcloud Desktop client 2.6.4 allowed to present any html (including local links) when responding with inva CVE-2020-81907.5Incorrect file permissions in Citrix ADC and Citrix Gateway before versions 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 al CVE-2020-81916.1Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and CVE-2020-81926.5A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger resource exhaustion (whe CVE-2020-81936.5Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and C CVE-2020-81946.5Reflected code injection in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and