A missing access check in Nextcloud’s circle API allows an authenticated user to add an existing but private circle to another circle simply by specifying its ID. Because each circle ID is generated from a 62‑character alphabet and is 15 characters long, the probability of discovering an unused ID is extremely low, yet any attacker who already knows a valid ID can use the API to link circles and thereby reveal membership relationships. The exposure is a privacy breach of who belongs to which private circle and may let an adversary infer sensitive collaboration patterns. This flaw is a classic example of an authorization bypass (CWE‑639).

The vulnerability affects Nextcloud Server versions 32.0.0 through 32.0.6 and 33.0.0 through 33.0.0, as well as the corresponding Enterprise Server releases 29.0.16.14, 30.0.17.8, 31.0.14.3, 32.0.7 and 33.0.1. All affected installations expose the circle API that permits adding circles by ID without an appropriate access check.

The CVSS score for this weakness is 2.6, indicating a low impact and a relatively high required skill level. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. The exploit requires the attacker to have API access and to know a legitimate circle ID; the high complexity of the IDs makes the attack path difficult to launch from scratch, yet an attacker with prior knowledge can perform the action without further privilege escalation. Overall the risk is moderate, largely due to potential privacy loss rather than system compromise.