地图 / No password confirmation required when using apptoken on sensitive endpoint

No password confirmation required when using apptoken on sensitive endpoint

访问控制 / Improper Privilege Management / #3566607

厂商: Nextcloud
严重程度: 低危 · CVSS 5.3
赏金: —
弱点: Improper Privilege Management
研究员: @npc
披露日期: 2026-10-27
资产: nextcloud/server
CVE: CVE-2026-77172

该报告还没有中文解读。

时间线

2026-02-21报告提交
2026-10-27公开披露

阅读 HackerOne 原文 ↗作者 @npc · 版权归作者与 Nextcloud 所有

同类报告

Unauthenticated access to sensitive user informationRazer · — · $500 Re-Sharing allows increase of privilegesNextcloud · 2020-09-28 OneAgent Unprivileged NTLM User CoercionDynatrace · 2025-10-15 · $750 [h1-2102] [Plus] User with Store Management Permission can Make changeDomainEnforcementState - that should be limited to User Management OnlyShopify · 2022-04-21 Sub-Dept User Can Add User's To Main Department.Lark Technologies · 2022-10-18 [H1-2006 2020] Exploiting multiple vulnerabilities to get hacker's payment ensuredh1-ctf · 2020-06-18

No password confirmation required when using apptoken on sensitive endpoint · 破甲 POJIA