# Access Control: Inject tasks into other users decks

Deck card move endpoint lacks authorization on destination stackId, letting any user inject cards into another user's stack.

- Payout: hidden
- Severity: medium
- Program: Nextcloud
- Found by: dedoc
- Disclosed: 2021-02-02
- CVE: CVE-2020-8179
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/867052
- Library page: https://bugbountylibrary.com/r/h1%3A867052
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:php vuln:access-control vuln:idor

**Target:** Deck app card move endpoint /apps/deck/cards/{id}
**Root cause:** The PUT /apps/deck/cards/{id} handler updates stackId without verifying the destination stack belongs to the requesting user.
**Steps:**
1. Create a card via `POST /apps/deck/cards` with `{"title":"SOME_TEST","stackId":1,"type":"plain"}`
2. Move the card via `PUT /apps/deck/cards/13` with body containing `stackId`
3. Intercept and change `stackId` to a stack id owned by another user (e.g. `6`)
4. Server returns `200 OK` and the card is placed in the victim's stack
**How found:** Noticed the move request carries a client-controlled stackId and tested substituting a stack id not owned by the attacker.
**Exploitation:** Authenticated attacker enumerates stack ids and issues a PUT to move their own card into a victim's stack, polluting the victim's deck.
**Insight:** On move/transfer endpoints, test whether the destination container id is authorized separately from the source object ownership; ownership of the card does not imply permission to write into an arbitrary target stack.