Nextcloud Server smart album access control flaw exposes unintended file metadata

The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewing the album, rather than the album owner's configuration. When an album owner shares a smart album with another user, that user's own folder configuration is used to determine which of the owner's files are searched, allowing them to discover files, including name, file ID, and other metadata, in folders the album owner never intended to include in the shared album. This requires the album owner to have shared a filter-based smart album with the attacker; it does not allow access to arbitrary users' files without such a share.

• The supplied affected data identifies Nextcloud Server versions less than 32.0.0 as affected under semver. The recorded default status is unaffected outside that condition.
• The CVE record does not name an exact fixed release. Do not infer that 32.0.0, or any later version, fixes every release branch.
• A separate multi-vulnerability notice lists this issue and gives an overall Nextcloud Server 32.0.x-before-32.0.12 range, but it does not assign that range to this issue individually. Exposure of the 32.0.x branch and later or parallel branches therefore remains unverified.

In the Nextcloud Server Photos app, filter-based smart albums build their file listing from the photosSourceFolders search configuration of the user viewing the album, rather than the album owner's configuration. When the owner shares the smart album with another user, the viewer's folder configuration becomes the effective search scope for the owner's files. The viewer can then discover file names, file IDs, and other metadata from folders that the owner did not intend to include in the shared album.

The supported high-level flow is:

1. The owner creates a filter-based smart album.
2. The owner shares that album with another user.
3. When the recipient views the album, the recipient's photosSourceFolders determines which of the owner's files are searched.
4. The results can include metadata for files outside the scope the owner intended to share.

The supplied weakness classification is CWE-284, Improper Access Control. The record describes network reachability and low required privileges, but it does not identify a specific endpoint, code location, or request format.

The issue is reachable over the network by a user who has low-level access to a shared smart album. The required condition is that the album owner has shared a filter-based smart album with that user; the flaw does not provide arbitrary access to other users' files without such a share.

Once the album has been shared, the record does not require additional user interaction for the recipient to observe the incorrect search scope. The supplied record does not record a public exploit, and current authoritative enrichment records exploitation as none and automatable as no. These statuses do not prove that undisclosed abuse has not occurred.

The confirmed technical outcome is that a smart album recipient can discover metadata for the owner's files outside the scope the owner intended to search. The primary impact is loss of confidentiality for file names, file IDs, and other metadata included in the results.

The issue is not described as enabling file modification or deletion, and the available evidence does not establish access to file contents. Exposure also depends on the owner having shared a filter-based smart album with a user who can view its results. The organizational risk is therefore centered on information disclosure and weakened sharing boundaries, not administrative takeover or service disruption.

The flaw can disclose file metadata outside the intended sharing scope, weakening the confidentiality of private albums and folders. The exposed metadata can include file names, file IDs, and other information returned by the search results; the available evidence does not establish that the flaw alone permits the recipient to download or read file contents.

The practical risk depends on whether the organization uses Photos, filter-based smart albums, and sharing of those albums with other users. The issue may reveal folder structure, the existence of documents, or descriptive file information to a recipient who was not meant to see that scope. The record does not describe an impact to data integrity or service availability.

1. Verify the release branch and upgrade to a Nextcloud Server build containing the corresponding vendor fix. The normalized record marks a patch as available, but the inspected data does not identify an exact fixed release for this issue.
2. Before declaring remediation complete, reconcile the installed version with an advisory or changelog for the exact branch in use. Do not treat the existence of a newer release as evidence that every branch is fixed.
3. Until the fix is verified, review and limit sharing of filter-based smart albums with untrusted users. This reduces the described trigger condition, but it is not a vendor-confirmed patch.
4. Review previously shared albums and assess whether recipients could have viewed metadata outside the intended scope. If exposure is found, follow the organization's incident assessment and notification procedures.

1. Check the Nextcloud Server inventory and determine whether any installation is below 32.0.0, which is the affected condition stated in the CVE data.
2. Identify systems with the Photos app enabled and inventory filter-based smart albums that are shared with other users.
3. For each shared album, compare the owner's intended folder scope with the metadata shown when the recipient views the album. This is a behavioral validation, not proof that an installation is safe if no discrepancy is found.
4. If audit logging is enabled, review recipient access to shared smart albums and related metadata-viewing activity. The record does not define a specific log event or IOC, so the absence of matching logs does not prove that the issue was not abused.
5. A separate multi-vulnerability notice lists this CVE together with an overall Nextcloud Server 32.0.x-before-32.0.12 range, but it does not map that range to this issue individually. Verify the exact branch and fix before concluding that 32.0.x or later branches are affected or remediated.