CVE-2018-16467

A missing check in Nextcloud Server prior to 14.0.0 could give unauthorized access to the previews of single file password protected shares.

• CWE-200
• CWE-287

• https://hackerone.com/reports/231917Exploit, Third Party Advisory
• https://nextcloud.com/security/advisory/?id=NC-SA-2018-014Vendor Advisory
• https://hackerone.com/reports/231917Exploit, Third Party Advisory
• https://nextcloud.com/security/advisory/?id=NC-SA-2018-014Vendor Advisory

Published

Oct 30, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-16461A command injection vulnerability in libnmapp package for ve…
• CVE-2018-16462A command injection vulnerability in the apex-publish-static…10
• CVE-2018-16463A bug causing session fixation in Nextcloud Server prior to …
• CVE-2018-16464A missing access check in Nextcloud Server prior to 14.0.0 c…
• CVE-2018-16465Missing state in Nextcloud Server prior to 14.0.0 would not …
• CVE-2018-16466Improper revalidation of permissions in Nextcloud Server pri…
• CVE-2018-16468In the Loofah gem for Ruby, through v2.2.2, unsanitized Java…
• CVE-2018-16469The merge.recursive function in the merge package <1.2.1 can…7.5
• CVE-2018-1647IBM QRadar Incident Forensics 7.2 and 7.3 does not properly …7.5
• CVE-2018-16470There is a possible DoS vulnerability in the multipart parse…
• CVE-2018-16471There is a possible XSS vulnerability in Rack before 2.0.6 a…
• CVE-2018-16472A prototype pollution attack in cached-path-relative version…7.5