CVE-2026-67400

A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token.

CVSS 3.0

3.5CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

CWE

CWE-284

Published

2026-10-27

Modified

2026-10-27

Record from

the CVE List, synced 2026-10-27

Affected

• nextcloud:richdocuments

References

• https://hackerone.com/reports/3568116

Check your stackJSON