CVE-2026-77170
published 2026-09-18CVE-2026-77170: The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has…
PriorityP426medium4.3CVSS 3.0
AVNACLPRLUINSUCNILAN
EPSS
0.27%
18.2th percentile
The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has permission to manage the referenced board.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| nextcloud | deck | 1.16.0 – 1.18.0 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has permission to manage the referenced board.
ghsa_unreviewed·2026-09-18
CVE-2026-77170 [MEDIUM] CWE-284 The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has permission to manage the referenced board.
The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has permission to manage the referenced board.
VulDB
Nextcloud Deck up to 1.18.0 Deck config API permission
vuldb·2026-09-18
CVE-2026-77170 [LOW] Nextcloud Deck up to 1.18.0 Deck config API permission
A vulnerability marked as problematic has been reported in Nextcloud Deck up to 1.18.0. This affects an unknown function of the component Deck config API. The manipulation leads to permission issues.
This vulnerability is uniquely identified as CVE-2026-77170. The attack is possible to be carried out remotely. No exploit exists.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-09-18
Published