CVE-2026-77170NVD

Description

The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has permission to manage the referenced board.

Severity Level

MEDIUM (4.3)

Published Date

18/09/2026

Last Modified

18/09/2026

Exploitation Status

????

EPSS Score

0.15% (percentile 4.8%)

CVSS Base Metrics

CVSS v3 (3.0)

MEDIUM 4.3

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weaknesses (CWE)

CWE-284 - CWE-284 Improper Access Control - Generic

Affected & Patched Versions

Product	Affected Versions	Patched Version
Nextcloud Deck	1.16.0 - <= 1.18.0	N/A

📧Email Delivery — Threat intel straight to your inbox.

♾️Unlimited Vendors — Track your entire stack.

🚨All New CVEs — Be the first to know.

⚙️Custom EPSS — Filter noise, focus on risk.

💬Webhooks — Slack & Teams integration.

🚫Ad-Free — Uninterrupted experience.