CVE-2020-8119

Improper authorization in Nextcloud server 17.0.0 causes leaking of previews and files when a...

4.3 MediumFix available

Improper authorization in Nextcloud server 17.0.0 causes leaking of previews and files when a file-drop share link is opened via the gallery app.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

Exploit likelihood

0.92%Down 0.1 points since Apr 14, 2021

What each source reports

NVD Score used 4.3

Improper authorization in Nextcloud server 17.0.0 causes leaking of previews and files when a file-drop share link is opened via the gallery app.

Record: CVE-2020-8119
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0: 4.0 MediumAV:N/AC:L/Au:S/C:P/I:N/A:N
Weakness: CWE-285, CWE-863
Updated: 2026-11-02

CVE List No score

Improper authorization in Nextcloud server 17.0.0 causes leaking of previews and files when a file-drop share link is opened via the gallery app.

Record: CVE-2020-8119
Weakness: CWE-285
Updated: 2026-11-02

EUVDEUVD-2020-29029 No score

Improper authorization in Nextcloud server 17.0.0 causes leaking of previews and files when a file-drop share link is opened via the gallery app.

Record: EUVD-2020-29029
Updated: 2026-11-03

GitHub AdvisoriesGHSA-rw2m-m5fq-rcj4 No score

Improper authorization in Nextcloud server 17.0.0 causes leaking of previews and files when a...

Improper authorization in Nextcloud server 17.0.0 causes leaking of previews and files when a file-drop share link is opened via the gallery app.

Record: GHSA-rw2m-m5fq-rcj4
Updated: 2026-11-02

OSV 4.3

Improper authorization in Nextcloud server 17.0.0 causes leaking of previews and files when a file-drop share link is opened via the gallery app.

Record: CVE-2020-8119
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

OSVopenSUSE-SU-2020:0220-1 No score

Security update for nextcloud

This update for nextcloud fixes the following issues:

Nextcloud was updated to 15.0.14:

NC-SA-2020-002, CVE-2019-15613: workflow rules to depend their behaviour on the file extension when checking file mimetypes (boo#1162766)
NC-SA-2019-016, CVE-2019-15623: Exposure of Private Information caused the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled (boo#1162775)
NC-SA-2019-015, CVE-2019-15624: Improper Input Validation allowed group admins to create users with IDs of system folders (boo#1162776)
NC-SA-2019-012, CVE-2020-8119: Improper authorization caused leaking of previews and files when a file-drop share link is opened via the gallery app (boo#1162781)
NC-SA-2019-014, CVE-2020-8118: An authenticated server-side request forgery allowed to detect local and remote services when adding a new subscription in the calendar application (boo#1162782)
NC-SA-2020-012, CVE-2019-15621: Improper permissions preservation causes sharees to be able to reshare with write permissions when sharing the mount point of a share they received, as a public link (boo#1162784)
To many changes. For detail see: https://nextcloud.com/changelog/

nextcloud was updated to 13.0.12:

Fix NC-SA-2020-001
To many changes. For detail see: https://nextcloud.com/changelog/

Record: openSUSE-SU-2020:0220-1
Updated: 2026-11-02

OSVopenSUSE-SU-2020:0229-1 No score

Security update for nextcloud

This update for nextcloud fixes the following issues:

Nextcloud was updated to 15.0.14:

NC-SA-2020-002, CVE-2019-15613: workflow rules to depend their behaviour on the file extension when checking file mimetypes (boo#1162766)
NC-SA-2019-016, CVE-2019-15623: Exposure of Private Information caused the server to send it's domain and user IDs to the Nextcloud Lookup Server without any further data when the Lookup server is disabled (boo#1162775)
NC-SA-2019-015, CVE-2019-15624: Improper Input Validation allowed group admins to create users with IDs of system folders (boo#1162776)
NC-SA-2019-012, CVE-2020-8119: Improper authorization caused leaking of previews and files when a file-drop share link is opened via the gallery app (boo#1162781)
NC-SA-2019-014, CVE-2020-8118: An authenticated server-side request forgery allowed to detect local and remote services when adding a new subscription in the calendar application (boo#1162782)
NC-SA-2020-012, CVE-2019-15621: Improper permissions preservation causes sharees to be able to reshare with write permissions when sharing the mount point of a share they received, as a public link (boo#1162784)
To many changes. For detail see: https://nextcloud.com/changelog/

nextcloud was updated to 13.0.12:

Fix NC-SA-2020-001
To many changes. For detail see: https://nextcloud.com/changelog/

This update was imported from the openSUSE:Leap:15.1:Update update project.

Record: openSUSE-SU-2020:0229-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`nextcloud` SUSE:Package Hub 12	before 15.0.14-bp151.3.3.1	15.0.14-bp151.3.3.1
`nextcloud` SUSE:Package Hub 15	before 15.0.14-bp151.3.3.1	15.0.14-bp151.3.3.1
`nextcloud` SUSE:Package Hub 15 SP1	before 15.0.14-bp151.3.3.1	15.0.14-bp151.3.3.1
`nextcloud` openSUSE:Leap 15.1	before 15.0.14-bp151.3.3.1	15.0.14-bp151.3.3.1
`nextcloud` SUSE:Package Hub 15 SP1	before 15.0.14-bp151.3.6.1	15.0.14-bp151.3.6.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, products	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-8119 is a medium vulnerability (CVSS 4.3) in Hackerone Nextcloud Server, published February 4, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.92%, the 60th percentile. Fixed in nextcloud 15.0.14-bp151.3.3.1.

References

Show 14 moreShow less