Secret Circle can be joined without approval in Nextcloud Circles

Vulnerability

The Nextcloud Circles application, in versions prior to 0.19.15, 0.20.11, and 0.21.4, allowed any authenticated user to join any "Secret Circle" without requiring approval from the circle owner. This bypasses the intended access control for secret circles, which are designed to be invitation-only. [1][2]

Exploitation

An attacker with a valid Nextcloud account can enumerate or guess the identifier of a Secret Circle and join it directly through the Circles API or user interface. No special privileges or additional user interaction is required; the attacker simply needs to be a member of the same Nextcloud instance. [1][2]

Impact

Successful exploitation leads to unauthorized access to the contents and membership list of a Secret Circle, resulting in information disclosure. The attacker can view posts, files, and other shared data within the circle, as well as the identities of other members. [1][2]

Mitigation

The vulnerability is fixed in Nextcloud Circles versions 0.19.15, 0.20.11, and 0.21.4. Users should upgrade to one of these patched versions. No workarounds are available. [1][2]