The vulnerability in Nextcloud Deck's config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has permission to manage the referenced board. This improper access control issue is classified under CWE-284. The flaw affects versions >=1.16.0 and <=1.18.0. The CVSS 3.0 base score is 4.3, indicating a medium severity with low complexity and no user interaction required. The impact is limited to integrity as it allows unauthorized configuration changes but does not affect confidentiality or availability.

The vulnerability enables authenticated users to modify configuration settings of boards they do not own or manage, potentially leading to unauthorized changes in board behavior or settings. There is no impact on confidentiality or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to trusted authenticated users and monitor for suspicious configuration changes. Avoid granting unnecessary permissions to users within Nextcloud Deck.