The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission. This access‑control flaw enables a legitimate group member to generate links that give unintended access to tables, potentially exposing sensitive information. The weakness is identified as CWE-284 and presents a moderate risk of data disclosure in affected deployments.

Nextcloud Tables installations that use group‑based link‑sharing restrictions are affected. All versions deploying this feature are vulnerable; no specific version is noted.

The CVSS score of 4.6 classifies the issue as moderate severity. An attacker must be a legitimate group member or have compromised one, so the vulnerability is exploitable only from inside the organization or via a stolen account. The EPSS score is not available and the flaw is not listed in the CISA KEV catalog, indicating low public exploitation risk. Nonetheless, an internal actor can create unauthorized share links, leading to disclosure of table contents.