Repository navigation
[Bug]: Password-protected share email exposes database password hash instead of plaintext in 35.0.2 #65479
Description
⚠️ This issue respects the following points: ⚠️
- This is not a troubleshooting question, general support matter, or webserver/proxy problem, but likely a bug (if unsure, ask the Community Help Forum).
- This issue is not already reported on Github OR solved at the Community Help Forum (I've searched!).
- I'm using a maintained major version of Nextcloud Server and tested against the latest patch level. (Supported major versions and current patch levels).
- I agree to follow Nextcloud's Code of Conduct.
- I've tried my best to provide clear reproduction steps that someone unfamiliar with this bug could use to reproduce it.
Bug description
The email contains the encrypted database hash (e.g., starting with $argon2id$... or $2y$...) instead of the actual plaintext password, rendering the share inaccessible and exposing the database hash format.
Steps to reproduce
- Create a new file or folder share via link in Nextcloud.
- Set a password for the share.
- Enter an email address to send the share notification directly from the Nextcloud interface.
- Check the received email.
Expected behavior
The email sent to the recipient should contain the plaintext password typed by the sender to unlock the share.
Nextcloud Server version
35
Operating system
Debian/Ubuntu
PHP engine version
PHP 8.5
Web server
Nginx
Database engine version
MariaDB
Is this bug present after an update or on a fresh install?
No response
Are you using the Nextcloud Server Encryption module?
Encryption is Disabled
What user-backends are you using?
- Default user-backend (database)
- LDAP/ Active Directory
- SSO - SAML
- Other
Configuration report
{
"system": {
"htaccess.RewriteBase": "\/",
"memcache.local": "\\OC\\Memcache\\APCu",
"apps_paths": [
{
"path": "\/var\/www\/html\/apps",
"url": "\/apps",
"writable": false
},
{
"path": "\/var\/www\/html\/custom_apps",
"url": "\/custom_apps",
"writable": true
}
],
"memcache.distributed": "\\OC\\Memcache\\Redis",
"memcache.locking": "\\OC\\Memcache\\Redis",
"redis": {
"host": "***REMOVED SENSITIVE VALUE***",
"password": "***REMOVED SENSITIVE VALUE***",
"port": 6379,
"timeout": 1.5,
"read_timeout": 1.5
},
"upgrade.disable-web": true,
"instanceid": "***REMOVED SENSITIVE VALUE***",
"passwordsalt": "***REMOVED SENSITIVE VALUE***",
"secret": "***REMOVED SENSITIVE VALUE***",
"trusted_domains": [
"***REMOVED SENSITIVE VALUE***",
"192.168.200.2",
"nextcloud-app",
"nextcloud-web"
],
"datadirectory": "***REMOVED SENSITIVE VALUE***",
"dbtype": "mysql",
"version": "35.0.2.1",
"overwrite.cli.url": "***REMOVED SENSITIVE VALUE***",
"overwriteprotocol": "https",
"overwritehost": "***REMOVED SENSITIVE VALUE***",
"skeletondirectory": "",
"dbname": "***REMOVED SENSITIVE VALUE***",
"dbhost": "***REMOVED SENSITIVE VALUE***",
"preview_max_x": 1024,
"preview_max_y": 1024,
"jpeg_quality": 60,
"trashbin_retention_obligation": "auto, 30",
"versions_retention_obligation": "auto, 180",
"dbtableprefix": "oc_",
"mysql.utf8mb4": true,
"dbuser": "***REMOVED SENSITIVE VALUE***",
"dbpassword": "***REMOVED SENSITIVE VALUE***",
"installed": true,
"allow_local_remote_servers": true,
"maintenance": false,
"enable_previews": true,
"preview_max_memory": 512,
"preview_concurrency_new": 1,
"preview_concurrency_all": 1,
"preview_imaginary_url": "***REMOVED SENSITIVE VALUE***",
"enabledPreviewProviders": [
"OC\\Preview\\Imaginary",
"OC\\Preview\\Krita",
"OC\\Preview\\MarkDown",
"OC\\Preview\\MP3",
"OC\\Preview\\OpenDocument",
"OC\\Preview\\TXT",
"OC\\Preview\\SVG",
"OC\\Preview\\MSOffice2003",
"OC\\Preview\\MSOffice2007",
"OC\\Preview\\MSOfficeDoc",
"OC\\Preview\\PDF",
"OC\\Preview\\PNG",
"OC\\Preview\\JPEG",
"OC\\Preview\\GIF",
"OC\\Preview\\BMP",
"OC\\Preview\\WebP",
"OC\\Preview\\Movie",
"OC\\Preview\\HEIC",
"OC\\Preview\\TIFF",
"OC\\Preview\\Photoshop",
"OC\\Preview\\Illustrator",
"OC\\Preview\\Font"
],
"preview_ffmpeg_path": "\/usr\/bin\/ffmpeg",
"preview_ffprobe_path": "\/usr\/bin\/ffprobe",
"push.server": "***REMOVED SENSITIVE VALUE***",
"ldapProviderFactory": "OCA\\User_LDAP\\LDAPProviderFactory",
"forbidden_filename_basenames": [
"con",
"prn",
"aux",
"nul",
"com1",
"com2",
"com3",
"com4",
"com5",
"com6",
"com7",
"com8",
"com9",
"lpt1",
"lpt2",
"lpt3",
"lpt4",
"lpt5",
"lpt6",
"lpt7",
"lpt8",
"lpt9"
],
"forbidden_filename_characters": [
"<",
">",
":",
"\"",
"|",
"?",
"*",
"\\",
"\/"
],
"defaultapp": "files",
"maintenance_window_start": "03:00",
"default_phone_region": "IT",
"mail_smtpmode": "smtp",
"mail_sendmailmode": "smtp",
"mail_from_address": "***REMOVED SENSITIVE VALUE***",
"mail_domain": "***REMOVED SENSITIVE VALUE***",
"mail_smtphost": "***REMOVED SENSITIVE VALUE***",
"mail_smtpport": "587",
"mail_smtpauth": true,
"mail_smtpname": "***REMOVED SENSITIVE VALUE***",
"mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
"default_timezone": "Europe\/Rome",
"trusted_proxies": "***REMOVED SENSITIVE VALUE***",
"loglevel": 3,
"serverid": 1,
"session_lifetime": 31536000,
"remember_login_cookie_lifetime": 31536000,
"session_keepalive": true,
"auth.bruteforce.protection.enabled": false,
"token_auth_enforced": true,
"session_relaxed_expiry": true,
"token_auth_activity_update": 300,
"auto_logout": false,
"auth.storeCryptedPassword": false,
"app_install_overwrite": []
}
}List of activated Apps
Enabled:
- activity: 8.0.0
- admin_audit: 2.0.0
- announcementbanner: 2.8.1
- appstore: 2.0.0
- calendar: 6.6.2
- call_summary_bot: 3.5.0
- circles: 35.0.0
- cloud_federation_api: 2.0.0
- collectives: 4.7.1
- comments: 2.0.0
- contacts: 8.9.1
- contactsinteraction: 2.0.0
- dashboard: 8.0.0
- dav: 2.0.0
- deck: 1.19.0
- desktop_workspace: 0.18.4
- diskmap: 0.4.0
- drawio: 4.3.9
- eurooffice: 11.0.6
- external: 10.0.0
- federatedfilesharing: 2.0.0
- federation: 2.0.0
- files: 3.0.0
- files_accesscontrol: 6.0.0
- files_antivirus: 6.4.1
- files_automatedtagging: 6.0.0
- files_downloadlimit: 5.3.0
- files_external: 2.0.0
- files_lock: 35.0.0
- files_pdfviewer: 8.0.0
- files_reminders: 2.0.0
- files_retention: 6.0.0
- files_sharing: 2.0.0
- files_trashbin: 2.0.0
- files_versions: 2.0.0
- fileviewer: 0.5.6
- forms: 5.4.0
- groupfolders: 23.0.1
- impersonate: 6.0.0
- integration_giphy: 2.3.0
- logcleaner: 1.6.5
- login_notes: 1.9.0
- logreader: 8.0.0
- lookup_server_connector: 2.0.0
- memegen: 2.0.2
- nc_gantt: 2.3.1
- nextcloud_announcements: 7.0.0
- notes: 6.1.0
- notifications: 8.0.1
- notify_push: 1.4.1
- oauth2: 2.0.0
- office: 1.1.0
- ownershiptransfer: 1.6.0
- password_policy: 7.0.0
- photos: 8.0.0
- previewgenerator: 5.15.0
- privacy: 7.0.0
- profile: 2.0.0
- provisioning_api: 2.0.0
- recommendations: 8.0.0
- related_resources: 6.0.0
- serverinfo: 7.0.0
- settings: 2.0.0
- share_audit_dashboard: 0.8.2
- sharebymail: 2.0.0
- sharing: 1.0.4
- shortcuts: 1.0.2
- spreed: 25.0.5
- support: 7.0.0
- survey_client: 7.0.0
- systemtags: 2.0.0
- tables: 2.3.1
- tasks: 0.18.1
- text: 9.0.1
- theming: 3.0.0
- transfer: 1.0.3
- twofactor_backupcodes: 2.0.0
- updatenotification: 2.0.0
- user_ldap: 2.0.0
- user_saml: 8.4.0
- user_status: 2.0.0
- userrightsoverview: 1.1.0
- viewer: 8.0.0
- weather_status: 2.0.0
- webhook_listeners: 2.0.0
- whiteboard: 2.0.0
- workflowengine: 3.0.0
Disabled:
- app_api: 35.0.0 (installed 35.0.0)
- bruteforcesettings: 8.0.0 (installed 7.0.0)
- encryption: 3.0.1
- firstrunwizard: 8.0.0 (installed 5.0.0-dev.0)
- guests: 4.10.0 (installed 4.10.0)
- suspicious_login: 13.0.0
- twofactor_nextcloud_notification: 9.0.0
- twofactor_totp: 17.1.0 (installed 17.1.0)Nextcloud Signing status
No errors have been found.Nextcloud Logs
Additional info
Proposed Fix
I diagnosed the root cause and drafted this patch with the help of an AI assistant. However, I have manually traced the code flow, applied the patch, and thoroughly tested it on my 35.0.2rc2 environment to ensure it completely resolves the issue.
I apologize in advance for any typos or other errors; this is my first post on GitHub :)
The cleanest way to fix this without altering the core ShareManager logic is to intercept the mail execution in the ShareAPIController, temporarily disable the auto-mail trigger, and fire it manually after the share is created by re-injecting the plaintext password into the object (similar to the workaround already present in the sendShareEmail method).
File: apps/files_sharing/lib/Controller/ShareAPIController.php
Method: createShare()
Location: Around line 812 where $share = $this->shareManager->createShare($share);
Diff / Code Replacement:
Replace the standard try/catch block for createShare with the following:
$shouldSendMail = $share->getMailSend();
if ($shouldSendMail) {
$share->setMailSend(false); // Prevent the Manager from sending the hashed password
}
try {
$share = $this->shareManager->createShare($share);
} catch (HintException $e) {
$code = $e->getCode() === 0 ? 403 : $e->getCode();
throw new OCSException($e->getHint(), $code);
} catch (GenericShareException|\InvalidArgumentException $e) {
$this->logger->error($e->getMessage(), ['exception' => $e]);
throw new OCSForbiddenException($e->getMessage(), $e);
} catch (\Exception $e) {
$this->logger->error($e->getMessage(), ['exception' => $e]);
throw new OCSForbiddenException('Failed to create share.', $e);
}
// Trigger the mail manually with the plaintext password
if ($shouldSendMail) {
$share->setMailSend(true);
if ($password !== '') {
$share->setPassword($password);
}
$provider = $this->factory->getProviderForType($share->getShareType());
if ($provider instanceof \OCP\Share\IShareProviderWithNotification) {
$provider->sendMailNotification($share);
}
}
Activity
DavideConsy commentedon Oct 15, 2026
ShareAPIController.php
Fixed ShareAPIController.php for 35.0.2
[-][Bug]: Password-protected share email exposes database password hash instead of plaintext in 35.0.2rc2[/-][+][Bug]: Password-protected share email exposes database password hash instead of plaintext in 35.0.2[/+]DerDreschner commentedon Oct 16, 2026
Will be fixed once #65578 is released (v35.0.3).