# Missing server side controls when editing the board’s sharing permissions per user

Deck app enforced board permissions only client-side; a share-only user could tamper the GET /apps/deck/boards response to grant edit/manage and take over the board.

- Payout: hidden
- Severity: high
- Program: Nextcloud
- Found by: warsocks
- Disclosed: 2020-09-28
- CVE: CVE-2020-8182
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/827816
- Library page: https://bugbountylibrary.com/r/h1%3A827816
- Tags: area:web domain:web impact:integrity impact:privesc kind:bounty platform:hackerone sev:high technique:source-review vuln:access-control vuln:business-logic vuln:privilege-escalation

**Target:** Deck app board sharing API (GET /apps/deck/boards)
**Root cause:** Board permission checks (edit/manage/share) were enforced only in the client UI; the server trusted the client's permission state and did not re-validate on write actions.
**Steps:**
1. As admin, create users silvia and john; install Deck 0.8.0.
2. As silvia, create board 'board for testing' with a stack, share it with john granting only Share (uncheck Edit/Manage).
3. As john, open Deck; observe `GET /apps/deck/boards` returns `"permissionEdit":false,"permissionManage":false`.
4. In Burp Match-and-Replace, rewrite `"permissionEdit":false,"permissionShare":true,"permissionManage":false,"owner":false` to all true.
5. Refresh Deck, open board details -> Sharing, grant self Edit/Share/Manage.
**How found:** Researcher noticed the UI hid edit/manage controls based on permission flags in the JSON response, hypothesized those flags were client-trusted, and confirmed by tampering the response to unlock the sharing UI.
**Exploitation:** Attacker with only Share permission intercepts the boards listing response, flips permissionEdit/permissionManage/owner to true via proxy match-replace, reloads the UI, and uses the now-enabled sharing controls to grant themselves full edit/manage on the board.
**Insight:** When a UI hides actions based on boolean permission flags in an API response, tamper those flags and check whether the server re-validates on the subsequent write request rather than trusting client state.