Nextcloud Server versions 32.0.0 through 34.0.0 contain an improper access control vulnerability that enables users to permanently lock files, leading to a denial of service for file owners.

This is an improper access control issue (CWE-284) that allows an authenticated user to place a TYPE_TOKEN lock on a file, which the original file owner cannot subsequently remove without direct database manipulation.

The inability to unlock files results in a loss of availability for critical data, potentially disrupting workflows and business operations. While the CVSS score of 6.5 reflects a medium severity, the impact on data accessibility is absolute for the affected files, necessitating prompt attention to restore administrative control over the file system.

Immediate Action: Update Nextcloud Server to the latest available version provided by the vendor to resolve the access control logic error.

Proactive Monitoring: Monitor server logs for unusual patterns of file locking activity or high volumes of lock requests originating from non-administrative accounts.

Compensating Controls: Restrict permissions for users who do not require advanced file locking capabilities and maintain regular database backups to allow for manual lock removal if an outage occurs.

Public Exploit Available: Unknown

Organizations utilizing Nextcloud Server must prioritize patching to the latest version to prevent potential denial of service scenarios within their file storage environment. Given the risk of permanent data unavailability for end users, administrators should verify that their update cycle addresses this specific access control flaw immediately.