{"id":"CVE-2026-82986","title":"The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission.","summary":"The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission.","severity":"medium","cvss":4.6,"cvssVector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-284"],"vendor":"Nextcloud","product":"Tables","affected":["Tables >= 0.6.4 <= 1.0.0"],"published":"2026-10-27","updated":"2026-10-27","sourceUpdated":"2026-10-27T16:15:34.671Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-82986","references":[{"url":"https://hackerone.com/reports/3642236"}],"tags":["cve.org"],"ingestedAt":"2026-10-27T16:32:34.407Z","slug":"CVE-2026-82986","body":"## Overview\n\nThe user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission.\n\n## Affected\n\n- `Tables >= 0.6.4 <= 1.0.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nThe user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission.","depth":"sunlit","depthScore":25,"depthScoreParts":{"impact":25.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}