Threats affecting pkg:github/maz1987in/3Dviewer-Nextcloud

CVE-2026-104189 is a vulnerability in the maz1987in 3Dviewer-Nextcloud app versions 1.7.9 through 3.3.1 where the public file endpoint did not enforce share authorization properly. This allowed anyone with a share token to access password-protected 3D model files without providing the password. The issue was fixed in version 3.3.2 by improving token and password validation and adding brute-force throttling.