# Shared smart albums in the Photos app can expose files outside the album owner's configured source folders

Nextcloud Photos smart albums use the viewer's photosSourceFolders config when searching the album owner's files, letting a sharee expand search scope to private folders.

- Payout: hidden
- Severity: medium
- Program: Nextcloud
- Found by (vendor credit): Joseph Semaan (suul)
- Found by: suul
- Disclosed: 2026-09-17
- CVE: CVE-2026-82985
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/3506873
- Library page: https://bugbountylibrary.com/r/h1%3A3506873
- Tags: area:web domain:web impact:data-leak impact:internal-access kind:bounty platform:hackerone sev:medium tech:php technique:source-review vuln:access-control vuln:idor vuln:info-disclosure

**Target:** Nextcloud Photos smart album preview API (/apps/photos/api/v1/preview)
**Root cause:** FiltersManager::getPhotosDefaultSearchConditions reads photosSourceFolders from the requesting user's config but applies the resulting path LIKE filters to the album owner's user folder, so the viewer's path scope overrides the owner's.
**Steps:**
1. Victim sets photosSourceFolders=["/Photos"], uploads secret.jpg to /Documents, shares /Photos with attacker.
2. Attacker sets own config: `PUT /apps/photos/api/v1/config/photosSourceFolders` body `{"value":"[\"/Photos\",\"/Documents\"]"}`.
3. Attacker obtains fileId of victim's /Documents/secret.jpg (e.g. 1566).
4. Attacker requests `GET /apps/photos/api/v1/preview/1566?x=256&y=256` and receives the file content.
5. Setting config to `["/"]` expands search to all victim folders.
**How found:** Code reading of FiltersManager revealed getUserConfig('photosSourceFolders') is called without a userId argument inside a function that searches another user's folder, indicating the requester's config is used against the owner's files.
**Exploitation:** Any authenticated user with access to a shared filter-based smart album sets their own photosSourceFolders to broader paths (or "/"), then requests previews by fileId; the search runs in the victim's folder with the attacker's path scope, returning files outside the shared album.
**Escalation:** Root path "/" expands the LIKE pattern to match all files in the victim's account, maximizing disclosure.
**Insight:** When a search/query helper takes a target userId but reads config from the ambient session user, that mismatch is the bug: grep for getUserConfig/getAppValue calls inside functions that operate on a passed-in userId.