Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

FeedsContactPrivacy© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
nextcloud-calendar-sharee-publish — Nextcloud 35.0.0 — a calendar edit-sharee can publish the owner's calendar to an unauthenticated URL | Kitploit
Tools/GitHubGitHub/abraxas/nextcloud-calendar-sharee-publish
Vulnerability AnalysisExploitationWeb Application ExploitationInformation GatheringWeb SecurityPenetration TestingPapers & ResearchAPI SecurityLabs & Practice
GitHubabraxas/nextcloud-calendar-sharee-publish

nextcloud-calendar-sharee-publish

Nextcloud 35.0.0 — a calendar edit-sharee can publish the owner's calendar to an unauthenticated URL

View Repository
115 days agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Abraxas Labs - nextcloud-calendar-sharee-publish

abraxaslabs.tech  ·  github.com/abraxas  ·  @abraxas_null  ·  [email protected]  ·  nextcloud-calendar-sharee-publish

nextcloud-calendar-sharee-publish

Nextcloud Server 35.0.0 - Nextcloud GmbH

CalDAV PublishPlugin only checks {DAV:}write. Owner-limit limitAddressBookAndCalendarSharingToOwner defaults to no. A colleague you gave edit on a calendar can publish it. Anyone with the secret URL reads your non-PRIVATE events with no login.

A bad actor with edit on your calendar can turn it into a public URL. Anyone who has that URL can read your meetings and attendees without logging in.

IDno CVE yet
CWECWE-284, CWE-862
CVSSHigh: 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
ProductNextcloud Server
Affected35.0.0 (da02f41) official nextcloud:35.0.0-apache
Authwrite-sharee, then unauthenticated public read
LicenseGNU Affero GPL v3.0
Lab127.0.0.1 only

What an attacker can do

You share a calendar with a colleague as can edit. That colleague posts publish-calendar. Nextcloud mints a public calendar URL.

Then:

  • Anyone with the URL (no login) can read your events
  • They see titles, times, attendees (non-PRIVATE objects)
  • They cannot become you, and they cannot publish an address book this way
  • A view-only sharee cannot do this; edit is enough

Reshare of the calendar is forbidden. Publish is not. The owner-limit config exists and is off by default.

How I found it

PublishPlugin checks {DAV:}write, then dav / limitAddressBookAndCalendarSharingToOwner, which defaults to no. Calendar::updateShares forbids reshare when isShared(). Publish is a different verb. Write ACL still grants {DAV:}write to an edit-sharee.

I stood up official nextcloud:35.0.0-apache. Owner calendar labcal with a non-PRIVATE event SUMMARY NEXTCLOUD-CAL-SHAREE-PUBLISH-WITNESS.

First I sent MKCALENDAR. Sabre came back 405 MethodNotAllowed. I PUT the VEVENT anyway. 201. The calendar was there. The collection-create verb was the wrong door, not the wrong house.

Shared read-write to sharee. Sharee POST CS:publish-calendar returned 202. Unauth PROPFIND on the public URL contained the witness.

Lab

cd lab
./run.sh

Target only http://127.0.0.1:18344.

SUCCESS NEXTCLOUD-CAL-SHAREE-PUBLISH who=write-sharee unauth-read=yes NEXTCLOUD-CAL-SHAREE-PUBLISH-WITNESS
  • lab/docker-compose.yml
  • lab/Dockerfile
  • lab/run.sh

The fix

Require the owner principal for publish, or default the owner-limit on and still deny publish for isShared() calendars. Reshare is already forbidden. Publish should follow it.

References

  • github.com/nextcloud/server tag v35.0.0
  • Abraxas Labs: abraxaslabs.tech · github.com/abraxas · @abraxas_null

License

GNU Affero GPL v3.0. See LICENSE. Loopback lab only. No warranty.

Download Tool