The vulnerability is an authorization flaw in Nextcloud Server that allows an authenticated attacker who knows another user’s principal URL to capture full access to that user’s calendar. By exploiting this flaw, the attacker can view and modify calendar events, compromising confidentiality and integrity. The flaw is a classic example of CWE‑639, an authorization bypass that permits a user to gain privileges beyond those granted.

The flaw affects Nextcloud Server releases from 32.0.0 up to, but not including, 32.0.9, and from 33.0.0 up to, but not including, 33.0.3. The same issue is present in Nextcloud Enterprise Server releases 31.0.14.5, 30.0.17.9, 29.0.16.16, 28.0.14.17, 27.1.11.26, 26.0.13.26, 25.0.13.29, 24.0.12.34, 23.0.12.35, 22.2.10.39, and 21.0.9.23. Only patched versions 32.0.9/33.0.3 and the corresponding enterprise releases address the issue.

With a CVSS base score of 8.1, the vulnerability is classified as high severity. Exploit probability is not available but the lack of presence in the CISA KEV catalog suggests no widespread exploitation has been observed. The attack requires the attacker to be an authenticated user, possess knowledge of a target principal URL, and send a carefully crafted group-member-set update request. While no remote code execution capabilities are disclosed, the ability to modify calendar data and impersonate other users poses a significant threat to confidentiality and integrity within an organization.