CVE-2026-82984 When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member o
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-82984?
CVE-2026-82984 is a medium-severity vulnerability in Nextcloud Server, published on 27 Oct 2026.
Official description
When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be called directly, allowing any authenticated non-member to enumerate the team's internal resources and their identifiers.
This does not grant access to the contents of the discovered resources themselves, only their existence, names, and identifiers.
Weakness: CWE-284
Which versions are affected by CVE-2026-82984?
How do I fix CVE-2026-82984?
No fix has been published for CVE-2026-82984 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-82984 being exploited?
There is no known exploitation of CVE-2026-82984 in the wild and no public exploit code.