{"id":"CVE-2024-37314","state":"PUBLISHED","title":"Nextcloud Photos' shared albums have no restriction on photo removal","description":"Nextcloud Photos is a photo management app. Users can remove photos from the album of registered users. It is recommended that the Nextcloud Server is upgraded to 25.0.7 or 26.0.2 and the Nextcloud Enterprise Server is upgraded to 25.0.7 or 26.0.2.","publishedAt":"2024-06-14T15:05:48.284Z","updatedAt":"2024-08-02T03:50:56.192Z","severity":{"score":3.5,"label":"Low","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","source":"GitHub_M"},"assigner":"GitHub_M","products":["nextcloud security-advisories"],"affected":[{"vendor":"nextcloud","product":"security-advisories","versions":[{"version":">= 25.0.1, < 25.0.7","status":"affected"},{"version":">= 26.0.0, < 26.0.2","status":"affected"}]}],"references":["https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9chh-5prm-wp43","https://github.com/nextcloud/photos/pull/1749","https://hackerone.com/reports/1946298"],"weaknesses":["CWE-284"],"ingestedAt":"2026-10-29T20:07:30.303Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/37xxx/CVE-2024-37314.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-37314","state":"PUBLISHED","datePublished":"2024-06-14T15:05:48.284Z","dateUpdated":"2024-08-02T03:50:56.192Z","assignerShortName":"GitHub_M","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateReserved":"2024-06-05T20:10:46.498Z"},"containers":{"cna":{"title":"Nextcloud Photos' shared albums have no restriction on photo removal","descriptions":[{"lang":"en","value":"Nextcloud Photos is a photo management app. Users can remove photos from the album of registered users. It is recommended that the Nextcloud Server is upgraded to 25.0.7 or 26.0.2 and the Nextcloud Enterprise Server is upgraded to 25.0.7 or 26.0.2."}],"affected":[{"vendor":"nextcloud","product":"security-advisories","versions":[{"version":">= 25.0.1, < 25.0.7","status":"affected"},{"version":">= 26.0.0, < 26.0.2","status":"affected"}]}],"references":[{"url":"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9chh-5prm-wp43","name":"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9chh-5prm-wp43","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/nextcloud/photos/pull/1749","name":"https://github.com/nextcloud/photos/pull/1749","tags":["x_refsource_MISC"]},{"url":"https://hackerone.com/reports/1946298","name":"https://hackerone.com/reports/1946298","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-284","lang":"en","description":"CWE-284: Improper Access Control","type":"CWE"}]}],"providerMetadata":{"shortName":"GitHub_M","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateUpdated":"2024-06-14T15:05:48.284Z"},"source":{"advisory":"GHSA-9chh-5prm-wp43","discovery":"UNKNOWN"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-06-14T18:14:03.328991Z","id":"CVE-2024-37314","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-07-30T14:25:26.489Z"}},{"title":"CVE Program Container","references":[{"url":"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9chh-5prm-wp43","name":"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9chh-5prm-wp43","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://github.com/nextcloud/photos/pull/1749","name":"https://github.com/nextcloud/photos/pull/1749","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://hackerone.com/reports/1946298","name":"https://hackerone.com/reports/1946298","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T03:50:56.192Z"}}]}}}