A missing check of a relation in Nextcloud Server allows an authenticated user who can read any file comment to read the content of all comments, enabling the disclosure of sensitive discussion data across files.

The vulnerability affects Nextcloud Server versions 31.0.0 up to but not including 31.0.12, and 32.0.0 up to but not including 32.0.3. For Enterprise Server, all releases prior to the patched versions 21.0.9.20, 22.2.10.35, 23.0.12.31, 24.0.12.30, 25.0.13.25, 26.0.13.22, 27.1.11.22, 28.0.14.13, 29.0.16.10, 30.0.17.5, 31.0.12, and 32.0.3 are vulnerable.

The CVSS score of 6.8 indicates moderate severity. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog, implying the current exploitation likelihood is uncertain. The attack requires authentication to a file that contains a comment and an ability to read any comment; therefore, it leverages an authorization bypass (CWE‑639) that allows a user to read all comment data.