CVE-2020-8139: Fedoraproject Fedora

Medium severity, CVSS 6.5. EPSS: 1.5% chance of exploitation in the next 30 days.

A missing access control check in Nextcloud Server < 18.0.1, < 17.0.4, and < 16.0.9 causes hide-download shares to be downloadable when appending /download to the URL.

Affected products

• Fedoraproject Fedora: version 32 only
• Nextcloud Nextcloud Server: from 16.0.0, before 16.0.9 (fixed in 16.0.9); from 17.0.0, before 17.0.4 (fixed in 17.0.4); from 18.0.0, before 18.0.1 (fixed in 18.0.1)

Published 2020-03-20. Last modified 2026-06-17.