title: Nextcloud Deck vulnerable to authorization bypass
description: Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Broken access control allows a user to delete attachments of other users. There are currently no known workarounds. It is recommended that the Nextcloud Deck app is upgraded to 1.6.5 or 1.7.3 or 1.8.2.
problem types: CWE-639: Authorization Bypass Through User-Controlled Key
affected:
{
vendor: nextcloud
product: security-advisories
versions:
version: >= 1.60, < 1.6.5, status: affected
version: >= 1.7.0, < 1.7.3, status: affected
version: >= 1.8.0, < 1.8.2, status: affected
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
version: 3.1
]