CVE-2020-8179

Improper access control in Nextcloud Deck 1.0.0 allowed an attacker to inject tasks into other users decks.

• CWE-284
• CWE-269

• https://hackerone.com/reports/867052Permissions Required, Third Party Advisory
• https://nextcloud.com/security/advisory/?id=NC-SA-2020-022Vendor Advisory
• https://hackerone.com/reports/867052Permissions Required, Third Party Advisory
• https://nextcloud.com/security/advisory/?id=NC-SA-2020-022Vendor Advisory

Published

Jul 2, 2020

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-8173A too small set of random characters being used for encrypti…2.2
• CVE-2020-8174napi_get_value_string_*() allows various kinds of memory cor…8.1
• CVE-2020-8175Uncontrolled resource consumption in `jpeg-js` before 0.4.0 …5.5
• CVE-2020-8176A cross-site scripting vulnerability exists in koa-shopify-a…6.1
• CVE-2020-8177curl 7.20.0 through 7.70.0 is vulnerable to improper restric…7.8
• CVE-2020-8178Insufficient input validation in npm package `jison` <= 0.4.…9.8
• CVE-2020-8180A too lax check in Nextcloud Talk 6.0.4, 7.0.2 and 8.0.7 all…9.9
• CVE-2020-8181A missing file type check in Nextcloud Contacts 3.2.0 allowe…4.3
• CVE-2020-8182Improper access control in Nextcloud Deck 0.8.0 allowed an a…8
• CVE-2020-8183A logic error in Nextcloud Server 19.0.0 caused a plaintext …7.5
• CVE-2020-8184A reliance on cookies without validation/integrity check sec…7.5
• CVE-2020-8185A denial of service vulnerability exists in Rails <6.0.3.2 t…6.5