Nextcloud’s Collectives module failed to enforce proper access control after a page was deleted, allowing guests who had view‑only access to the collective to retrieve the deleted page from the trashbin. This flaw presents a privilege‑escalation–style vulnerability of CWE‑284, leading to inadvertent disclosure of content that should have been removed. The CVSS score of 2.6 reflects the low‑to‑moderate risk and the fact that no direct code execution or data manipulation is enabled, but the illicit read of sensitive material could be detrimental in regulated environments.

The issue affects Nextcloud installations from version 2.6.0 through just before version 4.3.0, specifically the Collectives application when a guest user with view‑only rights has access to a collective that contains pages that have been deleted. Administrators should audit their instances to determine whether any guests were granted view‑only access to such collectives prior to upgrading to the patched release.

Because the vulnerability can be exploited without administrator credentials—any guest with view‑only permissions to the collective can trigger the flaw—the attack vector is local to the application layer. The lack of an EPSS score and absence from the KEV catalog suggest current exploitation is not widespread, yet the potential for confidential data leakage warrants prompt action. The CVSS score underscores a moderate likelihood of impact should the vulnerability remain unpatched.