An application bug in the Richdocuments app for Nextcloud allows an attacker to query additional WOPI configuration information when using a valid user or guest token. The flaw is a missing token type check, which permits the app to return configuration details beyond what is normally exposed. The impact is the disclosure of potentially sensitive configuration data. The weakness is classified as CWE‑284, indicating an improper authorization control.

The vulnerability affects the Richdocuments application for Nextcloud. No specific product versions are listed, so all installations of this app are considered susceptible until the issue is patched.

The CVSS score of 3.5 indicates low severity. Because the EPSS score is not available and the issue is not listed in CISA’s KEV catalog, the likelihood of exploitation is expected to be low. The apparent attack surface is a web API endpoint that requires a valid user or guest token, so an attacker must already have authenticated access to benefit from the flaw. Conditional exploitation does not appear to be required, but the ability to retrieve configuration data could assist in further attacks if the information is sensitive.