Mail contact autocomplete bypasses administrator-configured user enumeration restrictions and expose member information outside the intended scope

Bug reported by Jaeho Nam was disclosed at September 4, 2026, 8:38 pm   |   Privacy Violation

A vulnerability was discovered in the Mail contact autocomplete feature of Nextcloud that allowed an authenticated user to bypass administrator-configured user enumeration restrictions and expose member information outside the intended scope. The vulnerability was present in the `ContactIntegrationController::autoComplete()` handler, which did not apply the stricter user enumeration controls used elsewhere in the product.

API token sent to URL dictated by an untrusted project .weblate file

Bug reported by type5afe was disclosed at September 4, 2026, 8:10 am   |   Information Disclosure

A vulnerability was discovered in the wlc Python library used to interact with the Weblate translation management system. The vulnerability allowed an untrusted .weblate file to specify the Weblate API URL, which could then receive the API token set in the environment. The API token was resolved independently and was not bound to a trusted URL source, allowing the secret to be sent to an attacker-chosen server.

Unauthenticated ?q= search query causes exponential pyparsing backtracking under a process-global lock in Weblate

Bug reported by type5afe was disclosed at September 4, 2026, 8:10 am   |   Uncontrolled Resource Consumption

A vulnerability was discovered in Weblate, an open-source translation management system. The vulnerability was caused by the search query grammar implementation in Weblate, which was built using the `pyparsing` library. The grammar was ambiguous at every position and did not enable memoization, leading to exponential backtracking during parsing of search queries with nested parentheses. This resulted in a significant performance impact, with a 33-byte query string consuming 52 seconds of CPU time. The parsing was performed while holding a process-global lock, causing all other search, browse, translate, and zen page requests to stall in the same worker process.