Just had some non-fun following up on Niels' post ( https://bsd.network/@niels/114106538216130985 ) about weird requests after upgrading to #Nextcloud 31.0.0.
TLDR: NC 31.0.0 seems to share user data by unclear-maybe-default for federated sharing (public access?). May include sensitive PII (Phone, Email, Address) based on settings.
To prevent this, set Admin Settings > Sharing > Federated Cloud Sharing > Allow people to publish their data to a global and public address book to off
Write-up: https://doing-stupid-things.as59645.net/nextcloud/self-hosting/dataleak/2025/03/08/es-ist-alles-in-der-next-cloud.html
Tobias Fiebig
npub13f…2s8zu
2025-03-08 00:30:54 UTC
Author Public Key
npub13fpe053rvpmx3x7rapedl5hxlf2a4utajcufsg6al2lywtdm9hyq82s8zuSeen on
wss://relay.momostr.pinkPublished at
2025-03-08 00:30:54 UTCEvent JSON
{
"id": "3b207eda45b662ceae10ba724b2776a3b6aecb206435f19e2d744d7b3a4e2e81",
"pubkey": "8a4397d2236076689bc3e872dfd2e6fa55daf17d963898235dfabe472dbb2dc8",
"created_at": 1741393854,
"kind": 1,
"tags": [
[
"proxy",
"https://wybt.net/@tfiebig/114123987628722613",
"web"
],
[
"t",
"nextcloud"
],
[
"proxy",
"https://wybt.net/users/tfiebig/statuses/114123987628722613",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://wybt.net/users/tfiebig/statuses/114123987628722613",
"pink.momostr"
],
[
"-"
]
],
"content": "Just had some non-fun following up on Niels' post ( https://bsd.network/@niels/114106538216130985 ) about weird requests after upgrading to #Nextcloud 31.0.0.\n\nTLDR: NC 31.0.0 seems to share user data by unclear-maybe-default for federated sharing (public access?). May include sensitive PII (Phone, Email, Address) based on settings.\n\nTo prevent this, set Admin Settings \u003e Sharing \u003e Federated Cloud Sharing \u003e Allow people to publish their data to a global and public address book to off\n\nWrite-up: https://doing-stupid-things.as59645.net/nextcloud/self-hosting/dataleak/2025/03/08/es-ist-alles-in-der-next-cloud.html",
"sig": "8fc822d8185df71070d6a0f3ec4c3df08e6ab2d98afb144f9bff522900674a13c7953b6a55e887951529f179372b3af814d2861efec6746e608ce8b8e3a4e1dd"
}