Summary
A missing authorization control in Nextcloud's 3D Viewer public file endpoint allows access to supported 3D files without validating the password protecting the associated link share. Anyone who knows the share token may be able to retrieve the file contents without a password or authenticated session.
A missing authorization control in Nextcloud's 3D Viewer public file endpoint allows access to supported 3D files without validating the password protecting the associated link share. Anyone who knows the share token may be able to retrieve the file contents without a password or authenticated session.
Affected context
The issue affects 3D Viewer deployments using vulnerable public file routes for link or email shares. It becomes risky when a share token is exposed but the share owner relies on password protection, expiration, or share-type restrictions to prevent access. Files must be in a format handled by the 3D Viewer; unrelated non-3D files in the same share are generally outside the affected scope.
The issue affects 3D Viewer deployments using vulnerable public file routes for link or email shares. It becomes risky when a share token is exposed but the share owner relies on password protection, expiration, or share-type restrictions to prevent access. Files must be in a format handled by the 3D Viewer; unrelated non-3D files in the same share are generally outside the affected scope.
Exploit preconditions
- Attack surface: The 3D Viewer's public file endpoint.
- Required access: Knowledge of a valid share token and the identifier of a supported 3D file.
- Authentication requirement: No authenticated Nextcloud session or share password is required by the affected route.
- Trigger point: A request to the public file route causes the application to load and return the shared file.
- Why exploitation is possible: The route is not recognized as a framework public-share controller, so normal password, expiry, token, and share-type authorization checks are bypassed.
- Attack surface: The 3D Viewer's public file endpoint.
- Required access: Knowledge of a valid share token and the identifier of a supported 3D file.
- Authentication requirement: No authenticated Nextcloud session or share password is required by the affected route.
- Trigger point: A request to the public file route causes the application to load and return the shared file.
- Why exploitation is possible: The route is not recognized as a framework public-share controller, so normal password, expiry, token, and share-type authorization checks are bypassed.
Why this happens
The vulnerability results from a missing authorization boundary between a public controller and Nextcloud's share-protection middleware. Although the route was marked as public, its controller type prevented the middleware from applying the checks normally used for password-protected shares.
The service layer also treated a matching share token as sufficient authorization instead of verifying the complete share state and permitted share type. This behavior maps primarily to CWE-306: Missing Authentication for Critical Function and is also consistent with CWE-863: Incorrect Authorization, because access decisions did not enforce the protections configured for the share.
The vulnerability results from a missing authorization boundary between a public controller and Nextcloud's share-protection middleware. Although the route was marked as public, its controller type prevented the middleware from applying the checks normally used for password-protected shares.
The service layer also treated a matching share token as sufficient authorization instead of verifying the complete share state and permitted share type. This behavior maps primarily to CWE-306: Missing Authentication for Critical Function and is also consistent with CWE-863: Incorrect Authorization, because access decisions did not enforce the protections configured for the share.
Potential impact
- Unauthorized users may retrieve password-protected 3D model files.
- Confidential design, engineering, architectural, or manufacturing data could be disclosed.
- Exposed share tokens may provide access beyond the share owner's intended audience.
- Organizations could experience privacy, intellectual property, or compliance impacts.
- Unauthorized users may retrieve password-protected 3D model files.
- Confidential design, engineering, architectural, or manufacturing data could be disclosed.
- Exposed share tokens may provide access beyond the share owner's intended audience.
- Organizations could experience privacy, intellectual property, or compliance impacts.
General mitigation guidance
Mitigation should restore a single, framework-integrated authorization path for every public share endpoint.
Defensive patterns include:
- Route public file controllers through the platform's dedicated public-share authorization abstraction.
- Require validation of the token, password, expiration state, and permitted share type before serving content.
- Treat possession of a share token as insufficient when additional protections are configured.
- Fail closed when share lookup fails, the share is expired, or the share type is unsupported.
- Apply brute-force throttling and consistent authorization checks to public endpoints.
- Reduce exposure by disabling unnecessary file-viewer functionality or avoiding password-protected share assumptions for affected content until controls are verified.
Mitigation should restore a single, framework-integrated authorization path for every public share endpoint.
Defensive patterns include:
- Route public file controllers through the platform's dedicated public-share authorization abstraction.
- Require validation of the token, password, expiration state, and permitted share type before serving content.
- Treat possession of a share token as insufficient when additional protections are configured.
- Fail closed when share lookup fails, the share is expired, or the share type is unsupported.
- Apply brute-force throttling and consistent authorization checks to public endpoints.
- Reduce exposure by disabling unnecessary file-viewer functionality or avoiding password-protected share assumptions for affected content until controls are verified.
How teams detect issues like this
Detection can combine application testing, code review, and runtime monitoring.
- Review public controllers to confirm they inherit from the platform's public-share authorization base and invoke password and token validation.
- Use static analysis to identify public routes that return file contents without centralized authorization checks.
- Test protected shares with and without authenticated sessions and passwords, verifying that protected content is not returned solely because a token is known.
- Monitor logs for repeated requests to public file endpoints, unusual token enumeration, and successful downloads without corresponding password-validation events.
- Enforce policy checks in CI so new public endpoints must demonstrate share authorization, expiry handling, and fail-closed behavior.
Detection can combine application testing, code review, and runtime monitoring.
- Review public controllers to confirm they inherit from the platform's public-share authorization base and invoke password and token validation.
- Use static analysis to identify public routes that return file contents without centralized authorization checks.
- Test protected shares with and without authenticated sessions and passwords, verifying that protected content is not returned solely because a token is known.
- Monitor logs for repeated requests to public file endpoints, unusual token enumeration, and successful downloads without corresponding password-validation events.
- Enforce policy checks in CI so new public endpoints must demonstrate share authorization, expiry handling, and fail-closed behavior.
