# Registered users can change app password permissions for any user

IDOR in Nextcloud authtoken settings lets any authenticated user flip filesystem permissions on another user's app password by changing the sequential token ID.

- Payout: $100
- Severity: low
- Program: Nextcloud
- Credited: netranger
- Disclosed: 2018-02-08
- CVE: CVE-2017-0936
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/297751
- Library page: https://bugbountylibrary.com/r/h1%3A297751
- Tags: domain:web impact:data-leak impact:privesc kind:bounty platform:hackerone sev:low tech:php vuln:access-control vuln:idor

**Target:** PUT /settings/personal/authtokens/{id} JSON endpoint
**Root cause:** The authtoken update handler loads the token by the client-supplied `id` from the JSON body without verifying it belongs to the authenticated user, so scope changes apply to arbitrary tokens.
**Steps:**
1. Login as user A, create an app password with 'Allow filesystem access' unchecked, note its authtoken ID from the PUT /index.php/settings/personal/authtokens/{id} request
2. Login as user B, create an app password with filesystem access unchecked
3. Intercept the PUT request when re-checking 'Allow filesystem access' for B's token
4. Replace `"id":<B_token>` in the JSON body with A's token ID and forward
5. Reconnect WebDAV with A's app password and `ls` — directory listing now succeeds, confirming permission was granted
**How found:** Researcher noticed the authtoken ID appears both in the URL and JSON body and is user-controlled, then tested whether the server validated ownership by swapping in another user's token ID.
**Exploitation:** Attacker who has compromised a victim's app password (which lacks filesystem scope) and holds any account on the same server can iterate sequential token IDs via the PUT endpoint to grant filesystem scope to the victim's token, then use it over WebDAV to read the victim's files.
**Escalation:** Automation over sequential IDs (starting at 1) to locate and flip the target token's scope without knowing its ID.
**Insight:** When an object ID appears in both the URL path and the JSON body, test whether the body value is trusted over the path — and whether sequential IDs let you target tokens you don't own.