{"id":"CVE-2026-82984","title":"When a team was configured as \"visible to everyone\", the web UI correctly blocked non-members from viewing the team (\"You are not a member of ...\"), but the resources API endpoint could still be called directly, allowing any authenticate…","summary":"When a team was configured as \"visible to everyone\", the web UI correctly blocked non-members from viewing the team (\"You are not a member of ...\"), but the resources API endpoint could still be called directly, allowing any authenticate…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvssSource":"cna","cwe":["CWE-284"],"vendor":"Nextcloud","product":"Server","affected":["Server >= 32.0.0 <= 33.0.0"],"published":"2026-10-27","updated":"2026-10-27","sourceUpdated":"2026-10-27T16:15:34.831Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-82984","references":[{"url":"https://hackerone.com/reports/3511955"}],"tags":["cve.org"],"ingestedAt":"2026-10-27T16:32:34.395Z","slug":"CVE-2026-82984","body":"## Overview\n\nWhen a team was configured as \"visible to everyone\", the web UI correctly blocked non-members from viewing the team (\"You are not a member of ...\"), but the resources API endpoint could still be called directly, allowing any authenticated non-member to enumerate the team's internal resources and their identifiers.\n\nThis does not grant access to the contents of the discovered resources themselves, only their existence, names, and identifiers.\n\n## Affected\n\n- `Server >= 32.0.0 <= 33.0.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}