CVE-2026-77164

Overview

A blind Server-Side Request Forgery vulnerability exists in the Nextcloud Circles app remote-instance signature verification process. Unauthenticated endpoints allow attackers to force the server to issue GET requests to arbitrary internal addresses before trust is established. While response bodies are not returned, this flaw enables internal network reconnaissance and service discovery.

Description

Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF protections. The public, unauthenticated endpoints POST /apps/circles/event/ and POST /apps/circles/incoming/ reach this code path, allowing any unauthenticated user to force the server to issue a GET request to an internal address. The response body of the internal request is never returned to the requester, so this is blind SSRF: an attacker can determine whether an internal service is reachable, but cannot read its response contents through this endpoint alone.

Impact

The vulnerability leads to a breach of network segmentation via blind SSRF, allowing unauthenticated external actors to probe internal network resources and local addresses. It impacts confidentiality of internal network topology and availability of local services if targeted with heavy request volumes. System integrity is not directly compromised through data exfiltration from the target service.

Remediation

Update the Nextcloud Circles app to the latest patched version provided by the vendor. Ensure that outbound requests from the Nextcloud server are restricted via network-level egress filtering to prevent access to private IP ranges and internal metadata services. Monitor web server access logs for anomalous requests to the endpoints POST /apps/circles/event/ and POST /apps/circles/incoming/.

Risk context

Rated as medium severity with a CVSS score of 6.2. Although the EPSS score is not specified and it is limited to a blind SSRF vector, immediate patching is recommended to prevent internal network mapping by unauthenticated remote actors.

Affected products

• Nextcloud Circles app
• Nextcloud server