CVE-2026-82985 in Nextcloud
Summary
by MITRE • 09/18/2026
The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewing the album, rather than the album owner's configuration. When an album owner shares a smart album with another user, that user's own folder configuration is used to determine which of the owner's files are searched — allowing them to discover files (name, file ID, and other metadata) in folders the album owner never intended to include in the shared album.
This requires the album owner to have shared a filter-based smart album with the attacker; it does not allow access to arbitrary users' files without such a share.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability described constitutes an authorization bypass within the Photos application, specifically affecting the logic governing filter-based smart albums. This flaw arises from a fundamental misconfiguration in how file listings are constructed for shared resources. When an album owner creates and shares a smart album defined by specific filters or folder sources, the system is designed to present only those files that match the criteria established at creation time. However, due to this implementation error, the application does not persistently bind the search scope to the original configuration provided by the owner. Instead, it dynamically resolves the file listing based on the photosSourceFolders setting of the user currently viewing or accessing the album. This architectural oversight means that the context used for filtering is determined by the consumer rather than the producer of the shared content.
From a technical perspective, this represents an instance where access control checks are performed against the wrong security principal's configuration data. The application fails to enforce isolation between the owner's intended scope and the viewer's local environment settings. Consequently, when a user accesses a shared smart album, their personal folder inclusion preferences override or supplement the original filter constraints. This allows the viewing user to traverse into directories that were explicitly excluded from the sharing parameters by the owner. The system effectively treats the viewer's configuration as authoritative for determining visibility, thereby negating the restrictive intent of the album creator.
The operational impact of this vulnerability is significant regarding data confidentiality and privacy expectations. An attacker who has been granted access to a shared smart album can exploit this logic flaw to discover files that were never intended to be part of that share. The disclosure includes sensitive metadata such as file names, unique file identifiers, and other associated attributes stored within the excluded folders. This constitutes an unauthorized information exposure where the boundary between private personal storage and shared collaborative space is blurred. Users rely on smart albums for curated sharing experiences, assuming that exclusions are respected; this flaw undermines that trust by allowing lateral movement into unshared directories through a single point of entry.
This vulnerability aligns with CWE-284, which describes Improper Access Control, as the application fails to properly restrict access to resources based on user roles or configurations. It also relates to CWE-601, URL Redirection to Untrusted Site, in terms of logic flow misdirection, though more accurately it fits CWE-732, Incorrect Permission Assignment for Critical Resource, because the resource (the file listing) is being accessed with permissions derived from an incorrect source context. In the MITRE ATT&CK framework, this behavior corresponds to T1083, File and Directory Discovery, as the attacker uses a legitimate feature of the application to enumerate files outside their authorized scope. It may also touch upon T1530, Data from Cloud Storage, if the underlying storage is cloud-based, indicating an exfiltration pathway for unauthorized data discovery.
Mitigation strategies must focus on enforcing strict context binding during resource resolution. The development team should ensure that when a smart album is shared, its search configuration and folder source definitions are immutable relative to the viewer's settings. The application logic must explicitly use the owner's photosSourceFolders or the original filter criteria stored with the album metadata, rather than querying the current user's local preferences during the listing generation phase. Additionally, implementing rigorous input validation on all parameters that influence access control decisions can prevent such context confusion. Regular security audits of sharing mechanisms and automated testing for authorization bypasses in collaborative features are essential to detect similar logic flaws before deployment.