CVE-2026-77170

MEDIUM 4.3

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has permission to manage the referenced board.

CWE	CWE-284
Vendor	nextcloud
Product	deck
Published	Sep 18, 2026

Stay Ahead of the Next One

Get instant alerts for nextcloud deck

Be the first to know when new medium vulnerabilities affecting nextcloud deck are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected Versions

Nextcloud / Deck

1.16.0 ≤ 1.18.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

hackerone.com: https://hackerone.com/reports/3599383

Credits

Dang Hung Vi (vidang04)