CVE-2022-31024

richdocuments is the repository for NextCloud Collabra, the app for Nextcloud Office collaboration. Prior to versions 6.0.0, 5.0.4, and 4.2.6, a user could be tricked into working against a remote Office by sending them a federated share. richdocuments versions 6.0.0, 5.0.4 and 4.2.6 contain a fix for this issue. There are currently no known workarounds available.

• CWE-284
• CWE-346

• https://github.com/nextcloud/richdocuments/pull/2161Issue Tracking, Patch, Third Party Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-94hr-7g4v-f53rIssue Tracking, Third Party Advisory
• https://hackerone.com/reports/1210424Permissions Required
• https://github.com/nextcloud/richdocuments/pull/2161Issue Tracking, Patch, Third Party Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-94hr-7g4v-f53rIssue Tracking, Third Party Advisory
• https://hackerone.com/reports/1210424Permissions Required

Published

Jun 2, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-31018Play Framework is a web framework for Java and Scala. A deni…7.5
• CVE-2022-31019Vapor is a server-side Swift HTTP web framework. When using …7.5
• CVE-2022-31020Indy Node is the server portion of a distributed ledger purp…8.8
• CVE-2022-31021Ursa is a cryptographic library for use with blockchains. A …5.3
• CVE-2022-31022Bleve is a text indexing library for go. Bleve includes HTTP…5.5
• CVE-2022-31023Play Framework is a web framework for Java and Scala. Verion…7.5
• CVE-2022-31025Discourse is an open source platform for community discussio…5.3
• CVE-2022-31026Trilogy is a client library for MySQL. When authenticating, …7.5
• CVE-2022-31027OAuthenticator is an OAuth token library for the JupyerHub l…6.5
• CVE-2022-31028MinIO is a multi-cloud object storage solution. Starting wit…7.5
• CVE-2022-31029AdminLTE is a Pi-hole Dashboard for stats and configuration.…4.8
• CVE-2022-3103off-by-one in io_uring module.7.8