Nextcloud Server versions 32.0.0 to before 32.0.9 and 33.0.0 to before 33.0.3 contain an improper access control vulnerability (CWE-284) that allows an authenticated attacker to access attachments of link shares by knowing the share token. This bypasses password protection and download restrictions on attachments. The attacker must know a documentId they own for direct file shares or guess a documentId within a shared folder to exploit the vulnerability. The attacker cannot access the shared file or folder itself, only the attachments. The vulnerability has a CVSS 3.1 base score of 6.5 (medium severity) with network attack vector, low attack complexity, and requires privileges but no user interaction. No known exploits in the wild have been reported. Nextcloud recommends upgrading to fixed versions to mitigate this issue.

An authenticated attacker with knowledge of a share token can bypass password protection and download restrictions to access attachments of shared links. This exposure is limited to attachments and does not extend to the shared files or folders themselves. The vulnerability could lead to unauthorized disclosure of attachment content but does not affect integrity or availability.

Nextcloud recommends upgrading affected Nextcloud Server instances to version 32.0.9 or 33.0.3. For Nextcloud Enterprise Server, upgrade to one of the following versions: 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9, 29.0.16.16, 28.0.14.17, or 27.1.11.5. No other remediation level or temporary fix is indicated. Patch status is confirmed by vendor advisory recommendations. Users should apply these updates to remediate the vulnerability.