Can access comments and attachments of deleted cards
Package
Deck
(Nextcloud)
Affected versions
>= 1.6.0
>= 1.7.0
>= 1.8.0
>= 1.9.0
>= 1.11.0
>= 1.12.0
Patched versions
1.6.6
1.7.5
1.8.7
1.9.6
1.11.3
1.12.1
Impact
A user with access to a deck board was able to access comments and attachments of already deleted cards.
Patches
It is recommended that the Nextcloud Deck app is upgraded to 1.6.6 or 1.7.5 or 1.8.7 or 1.9.6 or 1.11.3 or 1.12.1
Workarounds
References
For more information
If you have any questions or comments about this advisory: