# Acting under any different user via DB-stored credentials

Nextcloud stores admin's SMB login credentials for every user in oc_storages_credentials when admin views /settings/users, letting users act as admin.

- Payout: hidden
- Severity: high
- Program: Nextcloud
- Found by: alexanderhofstaetter
- Disclosed: 2021-03-01
- CVE: CVE-2021-22877
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1061591
- Library page: https://bugbountylibrary.com/r/h1%3A1061591
- Tags: area:web domain:web impact:internal-access impact:privesc kind:bounty platform:hackerone sev:high tech:php technique:source-review vuln:access-control vuln:privilege-escalation vuln:secrets-leak

**Target:** files_external SMB auth (LoginCredentials) / oc_storages_credentials table
**Root cause:** StorePasswordListener saves session credentials to oc_storages_credentials without verifying the session user matches the credential owner, so admin's credentials get written for every user when the user list is rendered.
**Steps:**
1. Configure external SMB mount with 'credentials saved in database'
2. Confirm oc_storages_credentials is empty
3. As admin, browse to `/settings/users`
4. Recheck table: an entry now exists for every user containing admin credentials
5. Log in as a normal user and access SMB shares using the stored admin credentials
**How found:** Users reported broken SMB mounts; researcher inspected oc_storages_credentials and noticed entries appeared for all users after admin visited /settings/users, tracing to credential persistence from session without ownership check.
**Exploitation:** Attacker needs only a low-privileged account. After an admin visits the user management page, the admin's LDAP/SMB password is stored in oc_storages_credentials under the attacker's user row; the attacker then accesses SMB shares with admin privileges and reaches internal resources.
**Escalation:** Low-priv user gains admin-level SMB access and internal network reachability via external shares.
**Insight:** When a feature persists session credentials keyed by user, test whether rendering other users' contexts (admin user list, impersonation, background jobs) writes the acting user's secret into other users' rows; check the credentials table after admin-only pages.