CVE-2026-87897
Quick assessment
Affected
Nextcloud whiteboard
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
发现一处服务端请求伪造（SSRF）漏洞，该漏洞可被利用来访问内部 Chrome 开发者工具协议（DevTools Protocol）API，从而导致其他用户的 JWT 身份验证令牌泄露。低权限攻击者可在受害者开始录制时持续利用此漏洞窃取其 JWT 令牌，进而获得对受害者白板的读写权限。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-87897
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user. A low privileged attacker could continually exploit this vulnerability to leak the JWT authentication token for another user when they start a recording, which then enables the attacker read/write access to the victim's Whiteboard.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Nextcloud | whiteboard | 1.0.0 ~ 1.0.0 | - |
|
II. Public POCs for CVE-2026-87897
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-87897
请登录查看更多情报信息。
Other References for CVE-2026-87897 (1)
Same Patch Batch · Nextcloud · 2026-10-27 · 9 CVEs total
| CVE-2026-77173 | LibreOffice 文件命名含#致敏感信息未标记 | |
| CVE-2026-77172 | 应用密码绕过敏感端点密码确认漏洞 | |
| CVE-2026-77167 | Nextcloud 未认证 federated share 端点拒绝服务漏洞 | |
| CVE-2026-77171 | 公共共享集体链接允许创建页面漏洞 | |
| CVE-2026-82983 | Tables 应用分享端点未验证权限导致信息泄露 | |
| CVE-2026-82986 | Tableau 用户可绕过管理员设置的分组链接共享限制。 | |
| CVE-2026-82984 | 某软件资源 API 存在越权枚举漏洞 | |
| CVE-2026-67400 | WOPI 配置信息泄露：缺失 Token 类型检查 |
IV. Related Vulnerabilities
Same weakness: CWE-918
-
CVE-2026-116680
Homebox generic notifier SSRF via HTTP redirect after URL va -
CVE-2026-116678
Vaultwarden: Icon endpoint SSRF fix bypass via second-stage -
CVE-2026-117565
Artalk before 2.10.1 Unauthenticated SSRF via Comment Page T -
CVE-2026-65120
NVIDIA TensorRT-LLM 服务器端请求伪造漏洞 -
CVE-2026-24269
NVIDIA TensorRT-LLM 服务器端请求伪造漏洞