
Improper Access Control - Generic (CWE-284)CVSS 3.2€235
Can download files on Android app without permission
hakuna
Disclosed on HackerOne · January 16, 2026
Publicly disclosed report · by hakuna
View original on HackerOneSummary:
If the owner of a file - of type PDF, document, image or presentation - shares it with a user and disable download, the user can still download it using the Android app.
Steps To Reproduce:
- As user1, in the "Files" app, create a folder containing files of different formats (PDF, .odt, .png, .odp...)
- Share the folder to user2 and uncheck "Allow download" (repeat this step twice as unchecking the box doesn't apply the first time)
- As user2, in the Android app, open: - a PDF: in the viewer click the top right menu, choose "Download as" and select "PDF document" or "PDF document as...". You receive a "Download completed" notification and can open and save the file on your phone. - a .odp: same as above