Previews are accessible without a watermark

Description

Impact

While the download should be hidden and the watermark should get applied the preview is still visible without

Patches

It is recommended that the Nextcloud Server is upgraded to 25.0.1 or 24.0.8
It is recommended that the Nextcloud Enterprise Server is upgraded to 25.0.1 or 24.0.8
It is recommended that the Nextcloud Office (Richdocuments) App is upgraded to 7.0.1 (for 25) or 6.3.1 (for 24)

Workarounds

No workaround available

References

• HackerOne
• PullRequest Nextcloud Server
• PullRequest Nextcloud Office (Richdocuments) App

For more information

If you have any questions or comments about this advisory:

• Create a post in nextcloud/security-advisories
• Customers: Open a support ticket at support.nextcloud.com