The vulnerability is a missing permission check that allowed authenticated users to request and read form submissions belonging to other users. This flaw exposes confidential data that should be restricted to the form creator and intended respondents. It is directly linked to information disclosure (CWE‑200) and inadequate authorization checks (CWE‑862).

The issue applies to the Nextcloud content collaboration platform in all releases prior to 5.2.6. Only instances running those older versions are vulnerable.

With a CVSS score of 6.5, the severity is moderate. No EPSS score is available, and the vulnerability is not yet listed in CISA’s KEV catalog. The attack can be executed by any authenticated user who can submit forms, so the threat is limited to users with valid credentials but potentially broad if many users can submit forms.