# File access control rules not enforced on image files

Nextcloud Files access control rules were bypassed via WebDAV search and the thumbnail preview API, letting an unprivileged user list and view protected files.

- Payout: hidden
- Severity: low
- Program: Nextcloud
- Found by: reinism
- Disclosed: 2018-06-15
- CVE: CVE-2018-3762
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/358339
- Library page: https://bugbountylibrary.com/r/h1%3A358339
- Tags: area:web domain:web impact:data-leak kind:bounty platform:hackerone sev:low tech:rest technique:legacy-endpoint vuln:access-control vuln:auth-bypass vuln:info-disclosure

**Target:** Files access control app / WebDAV search and files thumbnail preview API
**Root cause:** The Files access control app enforces tag-based restrictions on normal file access paths but not on the WebDAV search endpoint or the files thumbnail/preview API, which resolve files without checking the access-control rules.
**Steps:**
1. Install Nextcloud 13.0.2snap1, enable Files access control and Files automated tagging (v1.3.0).
2. As admin create invisible tag `Secret`, add automated tagging rule tagging all admin-group files, and an access control rule denying non-admin users access to `Secret`-tagged files.
3. Create unprivileged user `user`; via WebDAV as admin create `Secret_Folder/Secret_Subfolder/Secret_Picture.jpeg` and `Secret_Text.txt`.
4. Share `Secret_Folder` to `user` with no edit rights.
5. As `user`, use WebDAV search to recursively list all files with MIME types, bypassing the access rules.
6. Fetch protected image via `curl -u user 'https://test.frp.lv/index.php/apps/files/api/v1/thumbnail/1212/750/Secret_Folder/Secret_Subfolder/Secret_Picture.jpeg'` to download its contents.
7. If owner rendered previews, fetch text preview via `curl -u user '.../thumbnail/4096/4096/Secret_Folder/Secret_Subfolder/Secret_Text.txt'`.
**How found:** Researcher set up tag-based access control rules and noticed that WebDAV search and the thumbnail preview API returned files that the normal access path denied, testing both listing and content retrieval.
**Exploitation:** An unprivileged share recipient uses WebDAV search to enumerate all files recursively regardless of access-control tags, then requests arbitrary resolutions through the thumbnail API to retrieve protected image contents (and text previews if the owner had rendered them), with previews generated server-side on attacker request.
**Insight:** When a product enforces authorization via an app/plugin layer, test every alternate file-resolution endpoint (search, thumbnail/preview, versions, trash) since they often bypass the plugin's checks; preview APIs can also generate content on demand for files the owner never opened.