HackerOne Disclosed Reports - 2026-09-18

Medium
resolved

files_lock: a write-share collaborator can place a TYPE_TOKEN lock that permanently denies the file owner, survives share revocation and account delet

Bug reported by rz1027 was disclosed at September 18, 2026, 3:36 pm   |   Improper Access Control - Generic

A vulnerability was discovered in files_lock 33.0.4 on Nextcloud 33.0.3 that allowed a user with write-share permissions on a file to place a permanent lock on the file that could not be removed by the file owner or an administrator. The lock was stored in the database and persisted even after the collaborator's account was deleted or recreated. The only way to remove the lock was through direct database access, which was not documented in the application's administrative tools.

Critical
resolved

Unauthenticated API allows reading, writing to and deleting any user's private chat history on ████████

Bug reported by Juan Agustin Niccolini was disclosed at September 18, 2026, 6:04 am   |   Misconfiguration

An unauthenticated API was discovered that allowed reading, writing to, and deleting any user's private chat history on the organization's internal chatbot application. The API had no authentication mechanism in place, allowing an attacker to list all conversations, retrieve the complete message history of any conversation, create new conversations, and delete any conversation. The deletion of a conversation was incomplete, as the underlying messages remained retrievable even after the conversation was removed from the listing.