Bypass password confirmation via Context-dependent access control (CDCA)

Summary: Hi Team, After some testing in nextcloud server, i found Context-dependent access control when i delete workflow at the server ask for password confirmation but it can be bypassed if i directly request the delete endpoint.

CDCA is a security mechanism that restricts access to resources based on the context of the request. If CDCA is broken, an attacker can exploit this flaw to gain unauthorized access to resources. This can have serious consequences, such as data breaches, theft of credentials, and denial of service …