Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

ONLYOFFICE/onlyoffice-nextcloud

              master @ 334b3a0
            

Fixes

CVEs

CRITICAL

Peak severity

30.8%

Coverage

Highlights

Access Control: 7 prior fixes. Scrutinize any change in this area.

controller/sharingapicontroller.php: most-fixed (3 issues). Treat as high-risk during review.

8 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Access Control: Three separate fixes addressed different share types (circle, Talk, group) being omitted from permission enumeration, indicating a systemic gap where new share types are added without updating permission checks.

Privilege Escalation: Multiple escalated permission paths were fixed around resharing: one bypassed admin resharing policy, another failed to respect source share update permissions, and a third allowed stale unauthorized permissions to remain.

Authorization Bypass: The download callback path lacked JWT authentication and proper user-based read checks, allowing unauthorized file downloads. This is the most severe historical issue.