title: Default share permissions not respected for federated reshares
description: Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, default share permissions were not being respected for federated reshares of files and folders. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.
problem types: CWE-277: Insecure Inherited Permissions
affected:
{
product: security-advisories
vendor: nextcloud
versions:
status: affected, version: < 19.0.13
status: affected, version: >= 20.0.0, < 20.0.11
status: affected, version: >= 21.0.0, < 21.0.3
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
version: 3.1
]