# Shared file link - password protection bypass under certain conditions

Nextcloud's publicpreview.php rendered previews of password-protected image shares without checking the password, letting unauthenticated attackers with the share ID recover the full image.

- Payout: $50
- Severity: medium
- Program: Nextcloud
- Credited: netranger
- Disclosed: 2018-09-25
- CVE: CVE-2018-16467, CVE-2019-5449
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/231917
- Library page: https://bugbountylibrary.com/r/h1%3A231917
- Tags: domain:web impact:data-leak kind:bounty platform:hackerone sev:medium tech:php vuln:access-control vuln:auth-bypass vuln:info-disclosure

**Target:** files_sharing publicpreview.php endpoint
**Root cause:** The public preview AJAX handler fetches and renders a preview by share token without verifying that the share is password-protected or that the password was supplied.
**Steps:**
1. Share an image via link and set a password; note the 15-char share ID from the URL.
2. Confirm the share link prompts for a password.
3. Request `GET /nextcloud/index.php/apps/files_sharing/ajax/publicpreview.php?x=200&y=200&t=[share ID]` unauthenticated.
4. Increase x/y to retrieve a larger preview, ultimately recovering the whole image.
**How found:** Noticed that the public preview endpoint takes only the share token as an identifier and reasoned it might not enforce the share's password gate, then tested it directly against a password-protected image share.
**Exploitation:** Unauthenticated attacker who knows the share ID requests publicpreview.php with the token and arbitrary x/y dimensions; the server returns a rendered preview of the protected image without any password check, and by enlarging dimensions the attacker reconstructs the full image.
**Insight:** Preview/thumbnail endpoints that key off a share token often skip the share's auth checks — test every auxiliary endpoint (preview, download, avatar, OG-image) that accepts the token, not just the main share page.