[Bug]: Regression: Admin-privileged group members cannot see or assign users to existing groups in Nextcloud 31.0.4

[tceydeliler]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

In Nextcloud version 31.0.4, members of a group with Administration privileges - Users are unable to see the groups that were previously defined by the root user when accessing the Users section. They are also unable to add users to these existing groups. However, this was possible in version 30.0.6.

Steps to reproduce

1.Create a group (e.g., "OPERASYON") and assign it Administration privileges → Users.
2.Log in as a user who is a member of that group.
3.Go to Accounts section.
4.Attempt to assign a user to an existing group (defined previously by the root user).

Expected behavior

In version 30.0.6, members of a group with "Administration privileges - Users" could:
View all existing groups (even those created by the root/admin),
Assign users to these groups.

Nextcloud Server version

31

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.1

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "bulut.yasar.com.tr",
            "172.17.1.53",
            "127.0.0.1",
            "localhost",
            "yasar.com.tr",
            "10.65.8.100"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "31.0.4.1",
        "overwrite.cli.url": "https:\/\/bulut.yasar.com.tr",
        "overwrite.host": "bulut.yasar.com.tr",
        "overwrite.protocol": "https",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "default_phone_region": "TR",
        "default_language": "tr",
        "default_locale": "tr_TR",
        "force_locale": "tr_TR",
        "force_language": false,
        "available_languages": [
            "tr",
            "en"
        ],
        "maintenance": false,
        "maintenance_window_start": 1,
        "updater.release.channel": "stable",
        "memcache.local": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "filelocking.enabled": "true",
        "filesystem_check_changes": 1,
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 6379,
            "timeout": 0
        },
        "htaccess.RewriteBase": "\/",
        "ldapIgnoreNamingRules": false,
        "ldapUserCleanupInterval": 51,
        "ldapBackgroundSyncInterval": 60,
        "remember_login_cookie_lifetime": 86400,
        "session_lifetime": 7200,
        "session_keepalive": true,
        "auto_logout": true,
        "auth.webauthn.enabled": false,
        "trashbin_retention_obligation": "auto,7",
        "enable_avatars": false,
        "enable_previews": true,
        "profile.enabled": false,
        "allow_user_to_change_display_name": false,
        "allow_user_to_change_mail_address": false,
        "theme": "",
        "lost_password_link": "disabled",
        "defaultapp": "files",
        "knowledgebaseenabled": false,
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "smtp",
        "mail_sendmailmode": "smtp",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "25",
        "log_type": "file",
        "syslog_tag": "nextcloud",
        "logfile": "\/data\/nextcloud.log",
        "loglevel": 2,
        "logdateformat": "d.m.Y, H:i:s",
        "logtimezone": "Europe\/Istanbul",
        "log.condition": {
            "apps": [
                "admin_audit",
                "files",
                "dav",
                "core",
                "encryption"
            ]
        },
        "log_type_audit": "syslog",
        "syslog_tag_audit": "nextcloud",
        "logfile_audit": "",
        "app_install_overwrite": [
            "group_default_quota",
            "impersonate",
            "apporder",
            "webhooks",
            "adwelcomemail",
            "admin_notifications"
        ],
        "connectivity_check_domains": [
            "www.startpage.com",
            "www.eff.org"
        ],
        "activity_webhook": "https:\/\/bulut.yasar.com.tr\/nextcloud-webhook.php",
        "allow_local_remote_servers": true,
        "appstoreenabled": true,
        "skeletondirectory": "\/var\/www\/custom_skeleton",
        "templatedirectory": "",
        "ldapProviderFactory": "OCA\\User_LDAP\\LDAPProviderFactory",
        "impersonate_include_groups": [],
        "blacklisted_files": [],
        "files.chunked_upload.max_size": 20971520
    }
}

List of activated Apps

- activity: 4.0.0
  - admin_audit: 1.21.0
  - admin_notifications: 1.0.2
  - announcementcenter: 7.1.1
  - app_api: 5.0.2
  - apporder: 0.15.0
  - bruteforcesettings: 4.0.0
  - cloud_federation_api: 1.14.0
  - comments: 1.21.0
  - contactsinteraction: 1.12.0
  - dashboard: 7.11.0
  - dav: 1.33.0
  - federatedfilesharing: 1.21.0
  - files: 2.3.1
  - files_accesscontrol: 2.0.0
  - files_automatedtagging: 2.0.0
  - files_downloadlimit: 4.0.0
  - files_pdfviewer: 4.0.0
  - files_reminders: 1.4.0
  - files_retention: 2.0.1
  - files_sharing: 1.23.1
  - files_trashbin: 1.21.0
  - files_versions: 1.24.0
  - group_default_quota: 0.1.11
  - groupfolders: 19.0.4
  - groupquota: 0.2.2
  - impersonate: 2.0.0
  - lookup_server_connector: 1.19.0
  - mail: 5.0.3
  - metadata: 0.22.0
  - nextcloud_announcements: 3.0.0
  - notifications: 4.0.0
  - oauth2: 1.19.1
  - password_policy: 3.0.0
  - photos: 4.0.0-dev.1
  - privacy: 3.0.0
  - profile: 1.0.0
  - provisioning_api: 1.21.0
  - quota_warning: 1.21.0
  - recommendations: 4.0.0
  - related_resources: 2.0.0
  - serverinfo: 3.0.0
  - settings: 1.14.0
  - sharebymail: 1.21.0
  - side_menu: 5.1.0
  - support: 3.0.0
  - survey_client: 3.0.0
  - systemtags: 1.21.1
  - text: 5.0.0
  - theming: 2.6.1
  - theming_customcss: 1.18.0
  - twofactor_backupcodes: 1.20.0
  - updatenotification: 1.21.0
  - user_ldap: 1.22.0
  - user_retention: 1.14.0
  - viewer: 4.0.0
  - webhook_listeners: 1.2.0
  - workflow_script: 2.0.0
  - workflowengine: 2.13.0
Disabled:
  - circles: 31.0.0 (installed 24.0.0)
  - encryption: 2.19.0
  - federation: 1.21.0 (installed 1.14.0)
  - files_antivirus: 6.0.0 (installed 6.0.0)
  - files_external: 1.23.0
  - files_rightclick: 0.15.1 (installed 1.6.0)
  - firstrunwizard: 4.0.0 (installed 2.13.0)
  - geoblocker: 0.5.16 (installed 0.5.16)
  - ldap_contacts_backend: 1.11.0 (installed 1.11.0)
  - logreader: 4.0.0 (installed 2.13.0)
  - mail-main: 4.3.0-alpha.1
  - suspicious_login: 9.0.1
  - testapp: 1.0.0 (installed 1.0.0)
  - twofactor_nextcloud_notification: 5.0.0
  - twofactor_totp: 13.0.0-dev.0
  - user_status: 1.11.0 (installed 1.4.0)
  - weather_status: 1.11.0 (installed 1.4.0)
  - webhookapp: 1.0.0 (installed 1.0.0)

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

NO log about that issue. Only log:{"reqId":"ZTx2KZDuuRLxIgalCCpt","level":0,"time":"03.05.2025, 10:37:41","remoteAddr":"94.102.78.227","user":"286EA536-CF98-4FED-AC34-7BB20A8568B4","app":"core","method":"GET","url":"/core/preview?fileId=216906&x=32&y=32&mimeFallback=true&v=319c41&a=0","message":"Image->fixOrientation() Orientation: 6","userAgent":"Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Mobile Safari/537.36","version":"31.0.4.1","data":{"app":"core"}}
{"reqId":"pKM0XhxhA1Irf5ALRBHW","level":0,"time":"03.05.2025, 10:37:41","remoteAddr":"94.102.78.227","user":"286EA536-CF98-4FED-AC34-7BB20A8568B4","app":"core","method":"GET","url":"/core/preview?fileId=216921&x=32&y=32&mimeFallback=true&v=2e0082&a=0","message":"Image->fixOrientation() Orientation: 6","userAgent":"Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Mobile Safari/537.36","version":"31.0.4.1","data":{"app":"core"}}
{"reqId":"QdT4wq9LTG0Arqd2TuCg","level":0,"time":"03.05.2025, 10:37:41","remoteAddr":"94.102.78.227","user":"286EA536-CF98-4FED-AC34-7BB20A8568B4","app":"core","method":"GET","url":"/core/preview?fileId=216942&x=32&y=32&mimeFallback=true&v=e32fe6&a=0","message":"Image->fixOrientation() Orientation: 1","userAgent":"Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Mobile Safari/537.36","version":"31.0.4.1","data":{"app":"core"}}
{"reqId":"udbhzrJhagJbgiS8TliG","level":0,"time":"03.05.2025, 10:48:30","remoteAddr":"10.32.10.27","user":"286EA536-CF98-4FED-AC34-7BB20A8568B4","app":"core","method":"GET","url":"/core/preview?fileId=216915&x=32&y=32&mimeFallback=true&v=4cad80&a=0","message":"Image->fixOrientation() Orientation: 6","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36","version":"31.0.4.1","data":{"app":"core"}}
{"reqId":"lV9VLwWA9M6YpJWBAL5I","level":0,"time":"03.05.2025, 10:48:30","remoteAddr":"10.32.10.27","user":"286EA536-CF98-4FED-AC34-7BB20A8568B4","app":"core","method":"GET","url":"/core/preview?fileId=216950&x=32&y=32&mimeFallback=true&v=16a568&a=0","message":"Image->fixOrientation() Orientation: 6","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36","version":"31.0.4.1","data":{"app":"core"}}
{"reqId":"xRtVOrYlFU6GXsH8VlGJ","level":0,"time":"03.05.2025, 10:48:31","remoteAddr":"10.32.10.27","user":"286EA536-CF98-4FED-AC34-7BB20A8568B4","app":"core","method":"GET","url":"/core/preview?fileId=216896&x=32&y=32&mimeFallback=true&v=97d369&a=0","message":"Image->fixOrientation() Orientation: 6","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36","version":"31.0.4.1","data":{"app":"core"}}
{"reqId":"jTsPV1J7d8sxdzz4Aj0i","level":0,"time":"03.05.2025, 10:48:31","remoteAddr":"10.32.10.27","user":"286EA536-CF98-4FED-AC34-7BB20A8568B4","app":"core","method":"GET","url":"/core/preview?fileId=216982&x=32&y=32&mimeFallback=true&v=b43ee0&a=0","message":"Image->fixOrientation() Orientation: 6","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36","version":"31.0.4.1","data":{"app":"core"}}
{"reqId":"tqmOOf6F5T66IayWGGLB","level":0,"time":"03.05.2025, 10:48:31","remoteAddr":"10.32.10.27","user":"286EA536-CF98-4FED-AC34-7BB20A8568B4","app":"core","method":"GET","url":"/core/preview?fileId=216865&x=32&y=32&mimeFallback=true&v=658e0e&a=0","message":"Image->fixOrientation() Orientation: 6","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36","version":"31.0.4.1","data":{"app":"core"}}
{"reqId":"4Sd9NL36bU7zFSnSbOVO","level":0,"time":"03.05.2025, 10:48:31","remoteAddr":"10.32.10.27","user":"286EA536-CF98-4FED-AC34-7BB20A8568B4","app":"core","method":"GET","url":"/core/preview?fileId=216902&x=32&y=32&mimeFallback=true&v=0a8484&a=0","message":"Image->fixOrientation() Orientation: 6","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36","version":"31.0.4.1","data":{"app":"core"}}
{"reqId":"om4F5nAZ8SRhZIseSywA","level":0,"time":"03.05.2025, 10:48:32","remoteAddr":"10.32.10.27","user":"286EA536-CF98-4FED-AC34-7BB20A8568B4","app":"core","method":"GET","url":"/core/preview?fileId=216891&x=32&y=32&mimeFallback=true&v=c55948&a=0","message":"Image->fixOrientation() Orientation: 6","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36","version":"31.0.4.1","data":{"app":"core"}}

Additional info

This seems like a regression introduced after version 30.0.6. Please advise if this is intended behavior or a bug.

[solracsf]

Fixed by #52417 ?

[tceydeliler]

I don't know. It happens to my nextcloud. Any suggestion as workaround?

[solracsf]

Wait for the next minor release.

[JB1985]

Same with [Nextcloud Hub 9] (30.0.10)

[Franz-Heinz]

I can confirm on Nextcloud Hub 9 (30.0.10)

Only members of "admin" seem to be able to access the group list.

[tceydeliler]

Is this a conscious development or a bug?

[essetikappa]

Hi,
also here have same issue (nextcloud 31.04+php8.3+mariadb+local database auth).
If I add a group by the account with elevated privileges (not from admin group, but the one I've set in root privileges), when I refresh the page (or go elsewhere and then back) all groups (created by the user or by the admin) has disappeared.

[blizzz]

Fixed by #52417 ?

Probably not, it was reported not working on 31.0.5 RC1 either.

[tceydeliler]

Despite upgrading to the stable version 31.0.5, I still see that the same issue persists.