resolved
Application Data Hiding via Invalid `iconName` Causing Frontend Crash in Nextcloud Tables
Bug reported by ₜₕₑ Bₒy Wₕₒ Gₒₜ ᵢₙ was disclosed at October 20, 2026, 12:55 pm | Business Logic Errors
A vulnerability was discovered in the Tables application where invalid icon names were accepted by the backend without validation. When an invalid icon name was submitted, the frontend would crash during rendering, causing application data to become inaccessible to users. The issue stemmed from improper input validation on the backend, which failed to verify icon names against an allowed list before accepting them.
resolved
Deck app: Invalid tag color is accepted by API and breaks frontend UI
Bug reported by ₜₕₑ Bₒy Wₕₒ Gₒₜ ᵢₙ was disclosed at October 20, 2026, 12:55 pm | Business Logic Errors
A vulnerability was discovered in the Deck application's tag creation feature where the color parameter was not validated by the API. Invalid color values were accepted by the server and stored in the database, causing the tags section of affected boards to become non-functional. The tags could no longer be rendered or managed through the user interface, affecting all users with access to the compromised board. This resulted in a persistent denial of service at the feature level until the invalid data was manually removed from the backend.
resolved
Ordinary HEY user can make HEY originate authenticated mail from attacker-selected @hey.com addresses
Bug reported by Alnoman Kamil was disclosed at October 20, 2026, 9:35 am | Improper Access Control - Generic
A vulnerability was discovered in HEY's email service that allowed ordinary users to send authenticated emails from arbitrary HEY addresses without authorization. An attacker could create a temporary external account claiming any target HEY address using unrelated SMTP credentials, enqueue a message, and then delete the external account before delivery. This caused the message to be delivered through HEY's infrastructure while retaining the claimed identity and valid authentication signatures. The vulnerability was successfully reproduced, with messages displaying spoofed sender information being delivered to recipient inboxes with passing SPF, DKIM, and DMARC validation.