CVE-2021-35946: 
ownCloud vulnerability analysis and mitigation

A vulnerability in ownCloud versions prior to 10.8.0 allows a receiver of a federated share with database access to modify their own permissions. The vulnerability, identified as CVE-2021-35946, was disclosed on August 2, 2021, and affects the permission management system of ownCloud's federated sharing feature (ownCloud Advisory).

The vulnerability has been assigned a CVSS v3 Base Score of 5.7 with the vector AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N. It is categorized under CWE-266 (Incorrect Privilege Assignment), indicating a flaw in the privilege management system. The technical issue allows share recipients to modify the permissions granted to the receivers of the share, which should only be possible for the share owner (ManageEngine, ownCloud Advisory).

The vulnerability enables unauthorized elevation of permissions by federated share recipients who have database access. This could potentially lead to increased access rights beyond what was initially granted by the share owner (ownCloud Advisory).

The vulnerability has been fixed in ownCloud version 10.8.0 and later. The patch implements proper permission checks to ensure that only the share owner can update the granted permissions (ownCloud Advisory).