CVE-2019-15610 - Improper authorization in the Circles app 0.17.7 causes retaining access when an email address was removed from a circle

MEDIUM

Improper authorization in the Circles app 0.17.7 causes retaining access when an email address was removed from a circle

Published Feb 4, 2020

4.3

MEDIUM

CVSS 3.1

EPSS 0.83%

Improper authorization in the Circles app 0.17.7 causes retaining access when an email address was removed from a circle.

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
n/a	Nextcloud Circles	unknown	Affected 17.0.7

No remediation recorded yet.

Weaknesses (1)

CWE-285

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-6567		Advisory
https://hackerone.com/reports/673724		x_refsource_MISCPermissions RequiredThird Party Advisory
https://nextcloud.com/security/advisory/?id=NC-SA-2019-013		x_refsource_MISCVendor Advisory

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner hackerone

Published Feb 4, 2020

Updated Aug 5, 2024

Reserved Aug 26, 2019

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Red Hat

No data

ENISA EUVD

Assigner hackerone

Published Feb 4, 2020

Updated Aug 5, 2024

GitHub

No data