HackerOne Disclosed Reports - 2026-10-27

High
resolved

Cross-account XSS on app.basecamp.com: oEmbed option injection chained through Turbo defeats the CSP nonce

Bug reported by deivizzzz was disclosed at October 28, 2026, 4:58 am   |   Cross-site Scripting (XSS) - Generic

A cross-account cross-site scripting vulnerability was discovered in an embed display endpoint that rendered attacker-supplied HTML verbatim on the application origin without proper authentication checks. The vulnerability could be exploited by crafting a malicious embed with injected HTML and JavaScript that would execute with the victim's privileges when the embed was accessed. The vulnerability was chained with a content security policy bypass where a legitimate JavaScript library from an allowlisted CDN would apply the victim's CSP nonce to injected scripts, allowing arbitrary code execution. This permitted unauthorized access to CSRF tokens, private profile data, and the ability to modify victim account information without authorization.

Critical
resolved

Launchpad file read leaks production keys

Bug reported by Abdelmounaim Moulahcene was disclosed at October 28, 2026, 4:53 am   |   Path Traversal

A file-read vulnerability in a platform exposed production storage credentials. The vulnerable processing path was fixed, exposed credentials were rotated, and the old key was deleted.

Low
resolved

FederationController::remoteWopiToken() returns full Wopi entity without token type validation

Bug reported by Ibrahim el zein was disclosed at October 27, 2026, 11:33 am   |   Improper Access Control - Generic

Medium
resolved

SSRF on Nextcloud Whiteboard Application via Recordings to Unauthorised Access to Whiteboards

Bug reported by alex-elttam was disclosed at October 27, 2026, 11:26 am   |   Server-Side Request Forgery (SSRF)

Medium
resolved

Tables application does not respect sharing limitations set by admin

Bug reported by Samin Zavarkesh was disclosed at October 27, 2026, 11:22 am   |   Improper Access Control - Generic

Low
resolved

Users with read-only access to a Nextcloud Table can enumerate its share recipients via the Tables API

Bug reported by _dha was disclosed at October 27, 2026, 11:19 am   |   Information Disclosure

Medium
resolved

Unauthorized users can enumerate internal team resources via the Teams API when a team is visible to everyone

Bug reported by _dha was disclosed at October 27, 2026, 11:17 am   |   Improper Access Control - Generic

Low
resolved

Unauthorised access with hidden public link creation when sharing to a Team External Member

Bug reported by was disclosed at October 27, 2026, 11:10 am   |   Privilege Escalation

A vulnerability was discovered in the sharing functionality where unauthorized access could be gained through the creation of hidden public links when sharing content to a team external member.

Medium
resolved

Files Confidential tagging can be bypassed with # in filename

Bug reported by XavLimSG was disclosed at October 27, 2026, 11:00 am   |   Improper Access Control - Generic

Medium
resolved

Public shares remain accessible via alternate endpoints after owner account is disabled

Bug reported by hamza was disclosed at October 27, 2026, 10:50 am   |   Improper Access Control - Generic

High
resolved

Unauthenticated Persistent Denial-of-Service via Federated Share Injection

Bug reported by was disclosed at October 27, 2026, 10:43 am   |   Uncontrolled Resource Consumption

Medium
resolved

No password confirmation required when using apptoken on sensitive endpoint

Bug reported by Nicholas Carlini was disclosed at October 27, 2026, 10:40 am   |   Improper Privilege Management

Low
resolved

Permission Model filesystem over-grant via wildcard radix lookup

Bug reported by Malik was disclosed at October 27, 2026, 7:06 am   |   Improper Access Control - Generic

A flaw was discovered in Node.js Permission Model filesystem enforcement that allowed access to be granted to paths not matching wildcard read or write rules. When a requested path was shorter than the prefix of a wildcard grant, the radix tree lookup would stop comparing early and incorrectly treat the path as a match. This issue affected wildcard grants positioned directly under the root of the permission tree. This vulnerability impacted Node.js version 26.x.