The vulnerability allows any authenticated user who is not a member of a team to obtain the names and identifiers of that team's internal resources through a direct API call, even though the web UI correctly denies access. The data revealed by the API includes only metadata, not the actual contents of the resources, but the enumeration capability can expose sensitive information or serve as a foothold for further attacks. This weakness is rooted in inadequate access control, classified under CWE-284.

The affected product is Nextcloud Server. No specific version information is provided, so all installations of Nextcloud Server that expose the resources API may be impacted.

The CVSS score of 4.3 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in CISA KEV, suggesting limited evidence of active exploitation. The likely attack vector is a direct API call by any authenticated non-member; the attacker needs only to know the endpoint and be logged in, implying ease of exploitation once the API endpoint is known.