A public shared collective in Nextcloud Collectives always allowed recipients of the link to create pages. This flaw permits anyone with the link to add new pages to the collective, potentially leading to defacement, unwanted content, or subtle data manipulation. Since the vulnerability is not tied to privileged APIs and is driven solely by the sharing configuration, it presents a low-barrier exploit path.

Nextcloud Collectives applications are impacted. No specific version numbers were disclosed; all deployments using public shared collectives are potentially vulnerable.

The CVSS score of 3.5 indicates low severity, and the EPSS score is not provided, so widespread exploitation is unlikely at present. The vulnerability is not reported in CISA KEV. Attackers would likely exploit this by visiting a public collective link and creating pages via the normal web interface, making the vector web-based and straightforward.