The vulnerability stems from a flaw in the Team Folders app when combined with the Workspace app. Delegated administrators who are limited to API/REST operations can override the folder‑level access controls, enabling them to access or modify files in team folders without proper authorization. This flaw is a classic example of improper authorization, classified as CWE‑284. The consequences are unauthorized data disclosure or modification within team folders, potentially affecting all users who rely on these folders for collaboration.

The affected system is the Nextcloud Team Folders component. No specific version details are supplied; administrators should verify that their installation matches the latest software that includes the fix for this issue.

The CVSS score of 6.5 indicates moderate severity. The EPSS score of less than 1% suggests a low current exploitation probability, though the flaw could be more widely used if exploited. The vulnerability is not listed in CISA KEV, meaning it is not a known, actively exploited issue as of the latest data. Attackers can exploit it by authenticating as a delegated administrator through REST API calls to the Workspace app, then exercising elevated rights on team folders. Bypass of folder‑level ACLs eliminates the separation of duties that the Workspace app was designed to enforce.