CVE-2024-52516

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-52516
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-52516.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-52516
Aliases
  • GHSA-35gc-jc6x-29cm
Published
2024-11-15T16:55:18.934Z
Modified
2025-12-05T07:20:37.481619Z
Severity
  • 3.0 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N CVSS Calculator
Summary
Nextcloud Server's shares are not removed when user is limited to share with in their groups and being removed from one of them
Details

Nextcloud Server is a self hosted personal cloud system. When a server is configured to only allow sharing with users that are in ones own groups, after a user was removed from a group, previously shared items were not unshared. It is recommended that the Nextcloud Server is upgraded to 22.2.11 or 23.0.11 or 24.0.6 and Nextcloud Enterprise Server is upgraded to 22.2.11 or 23.0.11 or 24.0.6.

Database specific 
{
    "cwe_ids": [
        "CWE-269"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52516.json"
}
References

Affected packages

Git / github.com/nextcloud/server

Affected ranges

Type
GIT
Repo
https://github.com/nextcloud/server
Events
Introduced
e15fcecaf0d382cebff924ec2b1f5319e130c0e8
Fixed
39780506f0b4b171ba67eeb967a0b80f0dc62d0f
Database specific 
{
    "versions": [
        {
            "introduced": "28.0.0"
        },
        {
            "fixed": "28.0.9"
        }
    ]
}
Type
GIT
Repo
https://github.com/nextcloud/server
Events
Introduced
36ae775aa7c9af22bf33645a2d8807206ec6c85f
Fixed
5b8bbd375fefce3e9fb9564abcc395706bd1a622
Database specific 
{
    "versions": [
        {
            "introduced": "29.0.0"
        },
        {
            "fixed": "29.0.5"
        }
    ]
}

Affected versions

v28.*
v28.0.0
v28.0.1
v28.0.1rc1
v28.0.2
v28.0.2rc1
v28.0.2rc2
v28.0.2rc3
v28.0.2rc4
v28.0.2rc5
v28.0.3
v28.0.3rc1
v28.0.3rc2
v28.0.4
v28.0.4rc1
v28.0.5
v28.0.5rc1
v28.0.6
v28.0.6rc1
v28.0.7
v28.0.7rc1
v28.0.7rc2
v28.0.7rc3
v28.0.7rc4
v28.0.8
v28.0.8rc1
v28.0.9rc1
v29.*
v29.0.0
v29.0.1
v29.0.1rc1
v29.0.2
v29.0.2rc1
v29.0.2rc2
v29.0.3
v29.0.3rc1
v29.0.3rc2
v29.0.3rc3
v29.0.3rc4
v29.0.4
v29.0.4rc1
v29.0.5rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-52516.json"