{"id":"CVE-2026-82983","kind":"vulnerability","aliases":["CVE-2026-82983"],"related":[],"title":"Nextcloud Tables: share-listing endpoint leaks recipients to read-only users","description":"The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level permission on the table before returning the full list of share recipients (users, groups, and teams) along with their permission levels. A user who was only granted read-data access to a table, and who is correctly prevented from seeing this information in the web UI, could call the endpoint directly to enumerate everyone the table is shared with and their access levels.\n\nThis does not expose the table's data itself beyond what the read-data grant already permits, only the list of share recipients and their permission levels.","summary":"The Tables app's GET /apps/tables/share/table/{tableId} endpoint did not check manage permission before returning every share recipient and their access level. A user with only read-data access can call it directly and list who else the table is shared with.","severity":"low","cvss":3.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["nextcloud","other","self-hosted","tables-app"],"not_affected_if":["app-not-installed","no-read-only-shares"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-27T17:17:03+00:00","first_seen_at":"2026-10-27T17:32:46+00:00","triaged_at":"2026-10-27T17:35:01+00:00","updated_at":"2026-10-27T17:35:01+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-27T17:35:01Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Nextcloud Tables: share-listing endpoint leaks recipients to read-only users","impact":"low","summary":"The Tables app's GET /apps/tables/share/table/{tableId} endpoint did not check manage permission before returning every share recipient and their access level. A user with only read-data access can call it directly and list who else the table is shared with.","category":"other","nicknames":[],"who_cares":["nextcloud","self-hosted","tables-app"],"confidence":0.6,"needs_auth":"yes","worst_case":"Read-only users can enumerate table share recipients and their access levels.","analyst_note":"Sources give no affected or fixed Tables app version; check the NVD entry and the Nextcloud Tables release notes for the patched version.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["app-not-installed","no-read-only-shares"],"who_is_affected":"Teams running the Tables app on a server where some users have read-only access to shared tables. The exposure is the list of share recipients and their permission levels, not table contents beyond what the read grant already allows. Sites that do not use the Tables app, or that give shared users no read-only grants, can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.000567,"input_tokens":3412,"output_tokens":452,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-82983':16A,19A '/apps/tables/share/table':33B,79C 'access':48B,57B,122C,154C 'along':108C 'alreadi':172C 'app':27B,30B,72C 'beyond':165C 'call':59B,140C 'check':38B 'correct':129C 'could':139C 'cve':14A,17A 'data':56B,121C,163C,170C 'direct':61B,143C 'els':65B 'endpoint':6A,35B,77C,142C 'enumer':145C 'everi':43B 'everyon':146C 'expos':159C 'full':99C 'get':32B,78C 'grant':118C,171C 'group':105C 'host':24B 'inform':134C 'leak':7A 'level':49B,91C,112C,155C,183C 'list':5A,63B,76C,100C,176C 'manag':39B,90C 'manage-level':89C 'nextcloud':1A,20B 'permiss':40B,92C,111C,182C 'permit':173C 'prevent':130C 'read':11A,55B,120C,169C 'read-data':54B,119C,168C 'read-on':10A 'recipi':8A,45B,103C,179C 'request':86C 'return':42B,97C 'see':132C 'self':23B 'self-host':22B 'share':4A,44B,69B,75C,102C,150C,178C 'share-list':3A,74C 'tabl':2A,26B,29B,67B,71C,95C,125C,148C,161C 'tableid':34B,80C 'tables-app':25B 'team':107C 'ui':138C 'user':13A,51B,87C,104C,114C 'verifi':83C 'web':137C","nicknames":[],"mitigations":[],"who_affected":"Teams running the Tables app on a server where some users have read-only access to shared tables. The exposure is the list of share recipients and their permission levels, not table contents beyond what the read grant already allows. Sites that do not use the Tables app, or that give shared users no read-only grants, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T17:17:03+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"support@hackerone.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82983","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82983","severity":null,"published_at":"2026-10-27T17:17:03+00:00","modified_at":"2026-10-27T17:17:03+00:00","first_seen_at":"2026-10-27T17:32:46+00:00","fetched_at":"2026-10-27T17:32:46+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}