Nextcloud server is a self hosted system designed to provide cloud style services. In affected versions the User Status API did not consider the user enumeration settings by the administrator. This allowed a user to enumerate other users on the instance, even when user listings where disabled. It is recommended that the Nextcloud Server is upgraded to 20.0.14, 21.0.6 or 22.2.1. There are no known workarounds.
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*
FE354750-B4B3-4F0A-8B59-472C527BC7B2
20.0.14
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*
467AE8CC-B050-4A69-AD8A-88C71C69C898
21.0.6
21.0.0
cpe:2.3:a:nextcloud:nextcloud_server:22.2.0:*:*:*:*:*:*:*
0FB174BF-D3FD-49C6-B216-3166DE1AD6F9
OR
There should be an option to globally disable the "Last statuses" widget. It leaks account names, which might be the desired behaviour, but might as well be not.

On "semi-public" Nextcloud instances you usually don't want to expose other users to each other, which is also why e.g. `shareapi_allow_share_dialog_user_enumeration` can be disabled.

Currently it's only possible to disable user_status altogether. It would be nice if there was the option to keep user_status enabled but disable the "Last statuses" widget.
user_status "last statuses" widget leaks account names
This is a GitHub Issue
repo:server
owner:nextcloud
Title : user_status "last statuses" widget leaks account names
Issue date:

--- start body ---
There should be an option to globally disable the "Last statuses" widget. It leaks account names, which might be the desired behaviour, but might as well be not.

On "semi-public" Nextcloud instances you usually don't want to expose other users to each other, which is also why e.g. `shareapi_allow_share_dialog_user_enumeration` can be disabled.

Currently it's only possible to disable user_status altogether. It would be nice if there was the option to keep user_status enabled but disable the "Last statuses" widget.
--- end body ---

comments :
--- start comments ---

--- end comments ---