# cve.now: Nextcloud

The newest entries naming Nextcloud as an affected vendor (up to 200), of 306 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-82984](https://cve.now/CVE-2026-82984.md): When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member… (CVSS 4.3)
- [CVE-2026-77167](https://cve.now/CVE-2026-77167.md): Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc\_share\_external database table. (CVSS 7.5)
- [CVE-2026-77173](https://cve.now/CVE-2026-77173.md): A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and have it not… (CVSS 4.3)
- [CVE-2026-67400](https://cve.now/CVE-2026-67400.md): A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token. (CVSS 3.5)
- [CVE-2026-77171](https://cve.now/CVE-2026-77171.md): A public shared collective always allowed recipients of the link to create pages. (CVSS 3.5)
- [CVE-2026-77172](https://cve.now/CVE-2026-77172.md): App passwords were allowed to bypass password confirmation on sensitive endpoints. (CVSS 5.3)
- [CVE-2026-87897](https://cve.now/CVE-2026-87897.md): A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for… (CVSS 4.6)
- [CVE-2026-82983](https://cve.now/CVE-2026-82983.md): The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level… (CVSS 3.3)
- [CVE-2026-82986](https://cve.now/CVE-2026-82986.md): The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though… (CVSS 4.6)
- [CVE-2026-77165](https://cve.now/CVE-2026-77165.md): File owners were unable to unlock TYPE\_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of (CVSS 6.5)
- [CVE-2026-77166](https://cve.now/CVE-2026-77166.md): The emoji field in the page emoji update endpoint does not properly validate user input. (CVSS 2.4)
- [CVE-2026-68493](https://cve.now/CVE-2026-68493.md): After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they ar (CVSS 3.1)
- [CVE-2026-82985](https://cve.now/CVE-2026-82985.md): The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewi (CVSS 6.5)
- [CVE-2026-77164](https://cve.now/CVE-2026-77164.md): Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, (CVSS 6.2)
- [CVE-2026-77170](https://cve.now/CVE-2026-77170.md): The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the (CVSS 4.3)
- [CVE-2026-82982](https://cve.now/CVE-2026-82982.md): The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from app (CVSS 4.3)
- [CVE-2026-77169](https://cve.now/CVE-2026-77169.md): A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed API/REST-only deleg (CVSS 6.5)
- [CVE-2026-82980](https://cve.now/CVE-2026-82980.md): Any authenticated user can lock or unlock files they do not own by targeting absolute WebDAV paths of other users. (CVSS 6.3)
- [CVE-2026-45810](https://cve.now/CVE-2026-45810.md): Nextcloud: Propfind requests for file comments allowed to load comments for other files (CVSS 6.8)
- [CVE-2026-45722](https://cve.now/CVE-2026-45722.md): Nextcloud: Tables app allows limited SQLi in ORDER BY with malicious sort order argument for Table Views (CVSS 7.1)
- [CVE-2026-45691](https://cve.now/CVE-2026-45691.md): Nextcloud: Bypass of second factor authentication on DAV endpoints (CVSS 5.9)
- [CVE-2026-45690](https://cve.now/CVE-2026-45690.md): Nextcloud: Two-Factor Authentication Bypass via Pending Session Token Replay (CVSS 5.9)
- [CVE-2026-45545](https://cve.now/CVE-2026-45545.md): Nextcloud: SQL Injection in Column Type Parameter Allows Arbitrary SQL Execution (CVSS 8.2)
- [CVE-2026-45544](https://cve.now/CVE-2026-45544.md): Nextcloud: Information Disclosure of view filter metdata via Broken Sensitive Data Masking in ViewService (CVSS 4.3)
- [CVE-2026-45543](https://cve.now/CVE-2026-45543.md): Nextcloud: Deleting a Forms collaborator share leaves uploaded response files accessible through a lingering Files share (CVSS 5.3)
- [CVE-2026-45286](https://cve.now/CVE-2026-45286.md): Nextcloud: Calendar app leaked user identifiers via attendee suggestion endpoint (CVSS 4.3)
- [CVE-2026-45284](https://cve.now/CVE-2026-45284.md): Nextcloud: Wrong condition in the User OIDC app's LdapService allowed deleted LDAP users to authenticate (CVSS 4.6)
- [CVE-2026-45285](https://cve.now/CVE-2026-45285.md): Nextcloud: Hidden Public Link creation when sharing to a Team External Member (CVSS 6.4)
- [CVE-2026-45283](https://cve.now/CVE-2026-45283.md): Nextcloud: Files Lock app allows users to lock and unlock files of other users (CVSS 6.3)
- [CVE-2026-45282](https://cve.now/CVE-2026-45282.md): Nextcloud: Logged-in user bypasses share password and download restrictions on Text attachments via documentId leads to unauthorized file access (CVSS 6.5)
- [CVE-2026-45281](https://cve.now/CVE-2026-45281.md): Nextcloud: Cross-Account Calendar Takeover via Unauthorized Group-Member-Set Update (CVSS 8.1)
- [CVE-2026-45279](https://cve.now/CVE-2026-45279.md): Nextcloud: Limited path traversal via template API if using \`{lang}\` in config (CVSS 4.4)
- [CVE-2026-45278](https://cve.now/CVE-2026-45278.md): Nextcloud: Open Redirect in user\_oidc login flow via protocol-relative URL bypass (CVSS 3.3)
- [CVE-2026-45277](https://cve.now/CVE-2026-45277.md): Nextcloud: Information disclosure in Nextcloud Approval app via fileId parameter reveals workflow associations (CVSS 3.3)
- [CVE-2026-45275](https://cve.now/CVE-2026-45275.md): Nextcloud: Authorization bypass in approval feature allows unauthorized file sharing with approvers (CVSS 6.5)
- [CVE-2026-45267](https://cve.now/CVE-2026-45267.md): Nextcloud: Missing permission check for from submissions (CVSS 6.5)
- [CVE-2026-45266](https://cve.now/CVE-2026-45266.md): Nextcloud: Unauthorized force-mute from missing permission check when using internal signaling (CVSS 3.5)
- [CVE-2026-45159](https://cve.now/CVE-2026-45159.md): Nextcloud: Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owner (CVSS 3.5)
- [CVE-2026-45157](https://cve.now/CVE-2026-45157.md): Nextcloud: Valid share tokens allow to access tempory upload files of share owner (CVSS 6.3)
- [CVE-2026-45156](https://cve.now/CVE-2026-45156.md): Nextcloud: Authentication Bypass in ID4me handling via Missing JWT Signature Verification in User OIDC (CVSS 8.1)
- [CVE-2026-45155](https://cve.now/CVE-2026-45155.md): Nextcloud: Private circle can be added to another circle via API (CVSS 2.6)
- [CVE-2026-45154](https://cve.now/CVE-2026-45154.md): Nextcloud: Improper Access Control in Collectives (CVSS 2.6)
- [CVE-2026-45153](https://cve.now/CVE-2026-45153.md): Nextcloud: PIN bypass in PassCodeActivity via back button (CVSS 4.6)
- [CVE-2026-45264](https://cve.now/CVE-2026-45264.md): Nextcloud: ACL Rename Permission Bypass in Team Folders Allows Unauthorized File Renames (CVSS 4.3)
- [CVE-2026-44515](https://cve.now/CVE-2026-44515.md): Nextcloud News: Authenticated blind SSRF via feed URL (CVSS 2.3)
- [CVE-2025-66558](https://cve.now/CVE-2025-66558.md): Nextcloud Twofactor WebAuthn app was updated based on public key (CVSS 3.1)
- [CVE-2025-66556](https://cve.now/CVE-2025-66556.md): Nextcloud talk allows participants to blindly delete poll drafts of other users by ID (CVSS 3.5)
- [CVE-2025-66554](https://cve.now/CVE-2025-66554.md): Nextcloud Contacts vulnerable to Stored XSS in contacts app via organisation and title field (CVSS 3.5)
- [CVE-2025-66549](https://cve.now/CVE-2025-66549.md): Nextcloud Desktop discloses information when attempting to lock a file inside a end-to-end encrypted directory (CVSS 2.4)
- [CVE-2025-66545](https://cve.now/CVE-2025-66545.md): Nextcloud Groupfolders users with read-only permissions for team folder can restore deleted files from trash bin (CVSS 3.5)
- [CVE-2025-66515](https://cve.now/CVE-2025-66515.md): Nextcloud Approval app allows users to request approval for other users file (CVSS 2.7)
- [CVE-2025-66514](https://cve.now/CVE-2025-66514.md): Nextcloud Mail stored HTML injection in subject text (CVSS 3.5)
- [CVE-2025-66557](https://cve.now/CVE-2025-66557.md): Nextcloud Deck app allowed user with "Can share" permission to modify permissions of other non-owners (CVSS 5.4)
- [CVE-2025-66548](https://cve.now/CVE-2025-66548.md): Nextcloud Deck app allows to spoof file extensions by using RTLO characters (CVSS 3.3)
- [CVE-2025-66553](https://cve.now/CVE-2025-66553.md): Nextcloud Tables app allowed users to view columns metadata information of any table (CVSS 4.3)
- [CVE-2025-66551](https://cve.now/CVE-2025-66551.md): Nextcloud Tables is missing an ownership check which allows moving columns into tables of other users (CVSS 6.3)
- [CVE-2025-66513](https://cve.now/CVE-2025-66513.md): Nextcloud Tables app share information not limited to relevant users (CVSS 4.3)
- [CVE-2025-66550](https://cve.now/CVE-2025-66550.md): Nextcloud Calendar attachments of local files are offered to downloaded (CVSS 5.7)
- [CVE-2025-66546](https://cve.now/CVE-2025-66546.md): Nextcloud Calendar app allowed booking appointments without the generated token (CVSS 3.3)
- [CVE-2025-66511](https://cve.now/CVE-2025-66511.md): Nextcloud Calendar app used predictable proposal participant tokens (CVSS 4.8)
- [CVE-2025-66552](https://cve.now/CVE-2025-66552.md): Nextcloud Server admin\_audit does not log all actions on files in groupfolders (CVSS 4.3)
- [CVE-2025-66547](https://cve.now/CVE-2025-66547.md): Nextcloud Server users can modify tags on files that do not belong to them (CVSS 4.3)
- [CVE-2025-66512](https://cve.now/CVE-2025-66512.md): Nextcloud Server vulnerable to XSS in SVG images when opened outside of Nextcloud (CVSS 5.4)
- [CVE-2025-66510](https://cve.now/CVE-2025-66510.md): Nextcloud Server Contacts Search allowed users to retrieve contact information of other users beyond their contact list (CVSS 4.5)
- [CVE-2025-59788](https://cve.now/CVE-2025-59788.md): Cross-site scripting (XSS) vulnerability in a reachable files\_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0 (CVSS 6.4)
- [CVE-2025-58051](https://cve.now/CVE-2025-58051.md): Nextcloud Tables app allowed to include local file via PhpSpreadsheet when importing a table (CVSS 6.5)
- [CVE-2025-47794](https://cve.now/CVE-2025-47794.md): Nextcloud Server vulnerable to insecure temporary file creation, race with write access and permission (CVSS 2.6)
- [CVE-2025-47793](https://cve.now/CVE-2025-47793.md): Nextcloud Server and Groupfolders app vulnerable to bypass of group folder quota limit using attachment in text file (CVSS 4.3)
- [CVE-2025-47792](https://cve.now/CVE-2025-47792.md): Nextcloud Desktop 3rdparty applications can create share links via socket API (CVSS 5.0)
- [CVE-2025-47791](https://cve.now/CVE-2025-47791.md): Nextcloud Server's test remote endpoint is not rate limited (CVSS 4.3)
- [CVE-2025-47790](https://cve.now/CVE-2025-47790.md): Nextcloud Server doesn't request second factor after session timeout (CVSS 6.4)
- [CVE-2024-52509](https://cve.now/CVE-2024-52509.md): Nextcloud Mail app does not respect download permissions in shares (CVSS 3.5)
- [CVE-2024-52508](https://cve.now/CVE-2024-52508.md): Nextcloud Mail auto configurator can be tricked into sending account information to wrong servers (CVSS 8.2)
- [CVE-2024-52510](https://cve.now/CVE-2024-52510.md): Nextcloud Desktop client behaves incorrectly if the initial end-to-end-encryption signature is empty (CVSS 4.2)
- [CVE-2024-52507](https://cve.now/CVE-2024-52507.md): Share information of the Nextcloud Tables app is not limited to affected users (CVSS 3.5)
- [CVE-2024-52511](https://cve.now/CVE-2024-52511.md): Nextcloud Tables has an Authorization Bypass Through User-Controlled Key in Tables (CVSS 6.3)
- [CVE-2024-52512](https://cve.now/CVE-2024-52512.md): Nextcloud User OIDC has an open redirection when logging in with User OIDC (CVSS 3.3)
- [CVE-2024-52513](https://cve.now/CVE-2024-52513.md): Nextcloud Server's Attachments folder for Text app is accessible on "Files drop" and "Password protected" shares (CVSS 2.6)
- [CVE-2024-52514](https://cve.now/CVE-2024-52514.md): Nextcloud Server allows users to copy folder that contain files that are blocked by the files access control (CVSS 4.1)
- [CVE-2024-52515](https://cve.now/CVE-2024-52515.md): Nextcloud Server has incomplete sanitization of SVG files allows to embed other images into previews (CVSS 5.7)
- [CVE-2024-52516](https://cve.now/CVE-2024-52516.md): Nextcloud Server's shares are not removed when user is limited to share with in their groups and being removed from one of them (CVSS 3.0)
- [CVE-2024-52517](https://cve.now/CVE-2024-52517.md): Nextcloud Server's global credentials of external storages are sent back to the frontend (CVSS 4.6)
- [CVE-2024-52518](https://cve.now/CVE-2024-52518.md): Nextcloud Server is missing password confirmation when changing external storage options (CVSS 4.4)
- [CVE-2024-52519](https://cve.now/CVE-2024-52519.md): Nextcloud Server's OAuth2 client secrets were stored in a recoverable way (CVSS 2.7)
- [CVE-2024-52520](https://cve.now/CVE-2024-52520.md): Nextcloud Server's link reference provider can be tricked into downloading bigger files than intended (CVSS 5.7)
- [CVE-2024-52521](https://cve.now/CVE-2024-52521.md): Nextcloud Server has a potential hash collision for background jobs could skip queuing them (CVSS 2.6)
- [CVE-2024-52523](https://cve.now/CVE-2024-52523.md): Nextcloud Server Custom defined credentials of external storages are sent back to the frontend (CVSS 4.6)
- [CVE-2024-52525](https://cve.now/CVE-2024-52525.md): Nextcloud Server User password is available in memory of the PHP process (CVSS 1.8)
- [CVE-2024-37887](https://cve.now/CVE-2024-37887.md): Nextcloud Server's events information leaked with shared calendars on recurrence exceptions (CVSS 3.5)
- [CVE-2024-37886](https://cve.now/CVE-2024-37886.md): Nextcloud user\_oidc's ID4me does not validate signature or expiration (CVSS 5.4)
- [CVE-2024-37885](https://cve.now/CVE-2024-37885.md): Code injection in Nextcloud Desktop Client for macOS (CVSS 3.8)
- [CVE-2024-37884](https://cve.now/CVE-2024-37884.md): Nextcloud Server's users can delete old versions of read-only shared files (CVSS 3.5)
- [CVE-2024-37883](https://cve.now/CVE-2024-37883.md): Nextcloud Deck can access comments and attachments of deleted cards (CVSS 4.3)
- [CVE-2024-37882](https://cve.now/CVE-2024-37882.md): Nextcloud Server can reshare read&share only folder with more permissions (CVSS 8.1)
- [CVE-2024-37317](https://cve.now/CVE-2024-37317.md): Nextcloud Notes app can be tricked into using a received share created before the user logged in (CVSS 4.6)
- [CVE-2024-37316](https://cve.now/CVE-2024-37316.md): Nextcloud Calendar's event create can create attachments that link to other websites (CVSS 4.6)
- [CVE-2024-37315](https://cve.now/CVE-2024-37315.md): Nextcloud Server's read-only users can restore old versions (CVSS 3.5)
- [CVE-2024-37314](https://cve.now/CVE-2024-37314.md): Nextcloud Photos' shared albums have no restriction on photo removal (CVSS 3.5)
- [CVE-2024-37313](https://cve.now/CVE-2024-37313.md): Nextcloud server allows the by-pass the second factor (CVSS 7.3)
- [CVE-2024-37312](https://cve.now/CVE-2024-37312.md): Nextcloud user\_oidc app's ID4me feature is available even when disabled (CVSS 6.3)
- [CVE-2024-30247](https://cve.now/CVE-2024-30247.md): Command Injection as root in NextCloudPi web panel (CVSS 10.0)
- [CVE-2024-22402](https://cve.now/CVE-2024-22402.md): Improper handling of request URLs in Nextcloud Guests app allows guest users to bypass app allowlist (CVSS 5.4)
- [CVE-2024-22401](https://cve.now/CVE-2024-22401.md): All users can reset the allowed apps list for Nextcloud Guest App users (CVSS 4.1)
- [CVE-2024-22404](https://cve.now/CVE-2024-22404.md): Permissions bypass in Nextcloud with the files zip app (CVSS 4.1)
- [CVE-2024-22403](https://cve.now/CVE-2024-22403.md): OAuth2 authorization codes are valid indefinetly in Nextcloud server (CVSS 3.0)
- [CVE-2024-22400](https://cve.now/CVE-2024-22400.md): Open redirect in user\_saml via RelayState parameter in Nextcloud User Saml (CVSS 3.1)
- [CVE-2024-22213](https://cve.now/CVE-2024-22213.md): Cross-site Scripting when sending HTML as a comment in the Nextcloud Deck app (CVSS 0.0)
- [CVE-2024-22212](https://cve.now/CVE-2024-22212.md): Nextcloud global site selector authentication bypass (CVSS 9.7)
- [CVE-2023-49792](https://cve.now/CVE-2023-49792.md): Bruteforce protection can be bypassed with misconfigured proxy (CVSS 5.3)
- [CVE-2023-49791](https://cve.now/CVE-2023-49791.md): Workflows do not require password confirmation on API level (CVSS 5.4)
- [CVE-2023-49790](https://cve.now/CVE-2023-49790.md): App PIN code can be bypassed in Nextcloud Files iOS (CVSS 4.3)
- [CVE-2023-48308](https://cve.now/CVE-2023-48308.md): Calendar app returns full stacktrace when an error happens while editing appointment (CVSS 3.5)
- [CVE-2023-48307](https://cve.now/CVE-2023-48307.md): Nextcloud Mail app vulnerable to Server-Side Request Forgery (CVSS 3.5)
- [CVE-2023-48306](https://cve.now/CVE-2023-48306.md): Nextcloud Server DNS pin middleware can be tricked into DNS rebinding allowing SSRF (CVSS 5.0)
- [CVE-2023-48305](https://cve.now/CVE-2023-48305.md): Nextcloud Server user\_ldap app logs user passwords in the log file on level debug (CVSS 4.2)
- [CVE-2023-48304](https://cve.now/CVE-2023-48304.md): Nextcloud Server vulnerable to attacker enabling/disabling birthday calendar for any user (CVSS 4.3)
- [CVE-2023-48303](https://cve.now/CVE-2023-48303.md): Nextcloud Server admins can change authentication details of user configured external storage (CVSS 2.4)
- [CVE-2023-48302](https://cve.now/CVE-2023-48302.md): Nextcloud Server vulnerable to Self XSS when pasting HTML into Text app with Ctrl+Shift+V (CVSS 3.5)
- [CVE-2023-48301](https://cve.now/CVE-2023-48301.md): Nextcloud Server HTML injection in search UI when selecting a circle with HTML in the display name (CVSS 3.5)
- [CVE-2023-48239](https://cve.now/CVE-2023-48239.md): Nextcloud Server users can make external storage mount points inaccessible for other users (CVSS 8.5)
- [CVE-2023-45150](https://cve.now/CVE-2023-45150.md): Inviting excessive long email addresses to a calendar event makes the Nextcloud server unresponsive (CVSS 4.3)
- [CVE-2023-45149](https://cve.now/CVE-2023-45149.md): Password of talk conversations can be bruteforced in Nextcloud (CVSS 4.3)
- [CVE-2023-45148](https://cve.now/CVE-2023-45148.md): Rate limiter not working reliable when Memcached is installed in Nextcloud (CVSS 4.3)
- [CVE-2023-45151](https://cve.now/CVE-2023-45151.md): OAuth2 client\_secret stored in plain text in the Nextcloud database (CVSS 6.5)
- [CVE-2023-45660](https://cve.now/CVE-2023-45660.md): Require strict cookies for image proxy requests in Nextcloud Mail (CVSS 4.3)
- [CVE-2023-39960](https://cve.now/CVE-2023-39960.md): Nextcloud Server has improper restriction of excessive authentication attempts on WebDAV endpoint (CVSS 5.0)
- [CVE-2023-39963](https://cve.now/CVE-2023-39963.md): Missing password confirmation when creating app passwords (CVSS 8.1)
- [CVE-2023-39962](https://cve.now/CVE-2023-39962.md): Users can delete external storage mount points (CVSS 7.7)
- [CVE-2023-39961](https://cve.now/CVE-2023-39961.md): Text does not respect "Allow download" permissions (CVSS 3.5)
- [CVE-2023-39959](https://cve.now/CVE-2023-39959.md): Existence of calendars and address books can be checked by unauthenticated users (CVSS 3.5)
- [CVE-2023-39958](https://cve.now/CVE-2023-39958.md): Missing brute force protection on password reset token OAuth2 API controller (CVSS 5.8)
- [CVE-2023-39957](https://cve.now/CVE-2023-39957.md): Path traversal allows tricking the Talk Android app into writing files into it's root directory (CVSS 7.2)
- [CVE-2023-39955](https://cve.now/CVE-2023-39955.md): Notes attachment render HTML in preview mode (CVSS 3.5)
- [CVE-2023-39954](https://cve.now/CVE-2023-39954.md): user\_oidc app stores client secret unencrypted in database (CVSS 3.8)
- [CVE-2023-39953](https://cve.now/CVE-2023-39953.md): Issuer not verified from obtained token in user\_oidc (CVSS 4.8)
- [CVE-2023-39952](https://cve.now/CVE-2023-39952.md): Advanced permissions not respected when copying entire group folders (CVSS 6.5)
- [CVE-2023-35928](https://cve.now/CVE-2023-35928.md): Nextcloud user scoped external storage can be used to gather credentials of other users (CVSS 8.5)
- [CVE-2023-35927](https://cve.now/CVE-2023-35927.md): Nextcloud system addressbooks can be modified by malicious trusted server (CVSS 7.6)
- [CVE-2023-35173](https://cve.now/CVE-2023-35173.md): End-to-End encrypted file-drops can be made inaccessible (CVSS 5.7)
- [CVE-2023-35172](https://cve.now/CVE-2023-35172.md): Nextcloud Server password reset endpoint is not brute force protected (CVSS 8.7)
- [CVE-2023-35171](https://cve.now/CVE-2023-35171.md): Nextcloud Server vulnerable to open redirect on "Unsupported browser" warning (CVSS 4.1)
- [CVE-2023-32320](https://cve.now/CVE-2023-32320.md): Nextcloud Server's brute force protection allows someone to send more requests than intended (CVSS 8.7)
- [CVE-2023-33183](https://cve.now/CVE-2023-33183.md): Error in calendar when booking an appointment reveals the full path of the website (CVSS 2.6)
- [CVE-2023-33182](https://cve.now/CVE-2023-33182.md): Nextcloud Contacts photos only sanitized if mime type is all lower case (CVSS 0.0)
- [CVE-2023-33184](https://cve.now/CVE-2023-33184.md): Blind SSRF in the Nextcloud Mail app on avatar endpoint (CVSS 3.5)
- [CVE-2023-32319](https://cve.now/CVE-2023-32319.md): Basic auth header on WebDAV requests is not brute-force protected in Nextcloud (CVSS 8.1)
- [CVE-2023-31128](https://cve.now/CVE-2023-31128.md): NextCloud Cookbook's pull-checks.yml workflow is vulnerable to OS Command Injection (CVSS 8.1)
- [CVE-2023-32318](https://cve.now/CVE-2023-32318.md): User session not correctly destroyed on logout (CVSS 7.2)
- [CVE-2023-32074](https://cve.now/CVE-2023-32074.md): Nextcloud user\_oidc app is missing brute force protection (CVSS 8.0)
- [CVE-2023-28847](https://cve.now/CVE-2023-28847.md): Nextcloud Server missing brute force protection for passwords of password protected share links (CVSS 3.1)
- [CVE-2023-30540](https://cve.now/CVE-2023-30540.md): Chat poll data can still be queried from API after purging history in Nextcloud talk (CVSS 3.5)
- [CVE-2023-30539](https://cve.now/CVE-2023-30539.md): Users can set up workflows using restricted and invisible system tags in Nextcloud (CVSS 6.5)
- [CVE-2023-29000](https://cve.now/CVE-2023-29000.md): Nextcloud Desktop client does not verify received singed certificate in end-to-end encryption (CVSS 5.4)
- [CVE-2023-28999](https://cve.now/CVE-2023-28999.md): Nextcloud: Lack of authenticity of metadata keys allows a malicious server to gain access to E2EE folders (CVSS 6.9)
- [CVE-2023-28998](https://cve.now/CVE-2023-28998.md): Nextcloud Desktop client misbehaves with E2EE when the server returns empty list of metadata keys (CVSS 6.7)
- [CVE-2023-28997](https://cve.now/CVE-2023-28997.md): Nextcloud Desktop: Initialization vector reuse in E2EE allows malicious server admin to break, manipulate, access files (CVSS 6.7)
- [CVE-2023-28848](https://cve.now/CVE-2023-28848.md): CSRF protection on user\_oidc login returned the expected token in case of an error (CVSS 4.8)
- [CVE-2023-28834](https://cve.now/CVE-2023-28834.md): Full path of data directory exposed to Nextcloud server users (CVSS 3.5)
- [CVE-2023-28845](https://cve.now/CVE-2023-28845.md): Chat room membership disclosed via autocompletion in Nextcloud talk (CVSS 3.5)
- [CVE-2023-28844](https://cve.now/CVE-2023-28844.md): User without download rights can download older version of that file in nextcloud server (CVSS 5.7)
- [CVE-2023-28645](https://cve.now/CVE-2023-28645.md): Secure view can be bypassed by using internal API endpoint in Nextcloud richdocuments (CVSS 5.7)
- [CVE-2023-28835](https://cve.now/CVE-2023-28835.md): Insecure randomness for default password in nextcloud (CVSS 3.5)
- [CVE-2023-28833](https://cve.now/CVE-2023-28833.md): Unrestricted filenames for logo or favicon as admin in the theming settings in nextcloud server (CVSS 2.4)
- [CVE-2023-28644](https://cve.now/CVE-2023-28644.md): Reference fetch can saturate the server bandwidth for 10 seconds in nextcloud server (CVSS 5.7)
- [CVE-2023-28643](https://cve.now/CVE-2023-28643.md): Potential share collision for recipients when caching is enabled in nextcloud server (CVSS 5.5)
- [CVE-2023-26482](https://cve.now/CVE-2023-26482.md): Scope of workflow operations is not validated in nextcloud server (CVSS 9.1)
- [CVE-2023-28646](https://cve.now/CVE-2023-28646.md): App lockout in nextcloud Android app can be bypassed via thirdparty apps (CVSS 4.4)
- [CVE-2023-28647](https://cve.now/CVE-2023-28647.md): App pin of the iOS app can be bypassed in Nextcloud iOS (CVSS 4.4)
- [CVE-2023-25817](https://cve.now/CVE-2023-25817.md): Delete permissions are not saved when creating public share in Nextcloud server (CVSS 3.5)
- [CVE-2023-25818](https://cve.now/CVE-2023-25818.md): Missing brute force protection on password reset token in Nextcloud Server (CVSS 5.3)
- [CVE-2023-25820](https://cve.now/CVE-2023-25820.md): Nextcloud Server and Enterprise Server missing brute force protection on password confirmation modal (CVSS 4.2)
- [CVE-2023-26041](https://cve.now/CVE-2023-26041.md): Nextcloud Talk messages can still be seen on conversation after expiring when cron is misconfigured (CVSS 2.6)
- [CVE-2023-25821](https://cve.now/CVE-2023-25821.md): Nextcloud download permissions can be changed by resharer (CVSS 5.7)
- [CVE-2023-25816](https://cve.now/CVE-2023-25816.md): nextcloud vulnerable to Uncontrolled Resource Consumption (CVSS 4.3)
- [CVE-2023-25579](https://cve.now/CVE-2023-25579.md): Directory traversal in Nextcloud server (CVSS 6.0)
- [CVE-2023-25162](https://cve.now/CVE-2023-25162.md): Nextcloud Server vulnerable to SSRF via filter bypass due to lax checking on IPs (CVSS 5.3)
- [CVE-2023-25161](https://cve.now/CVE-2023-25161.md): Nextcloud Server's missing rate limiting on password reset functionality allows sending lots of emails (CVSS 3.7)
- [CVE-2023-25160](https://cve.now/CVE-2023-25160.md): IDOR Vulnerability in Nextcloud Mail (CVSS 4.1)
- [CVE-2023-25159](https://cve.now/CVE-2023-25159.md): Nextcloud Server previews are accessible without a watermark (CVSS 2.3)
- [CVE-2023-25150](https://cve.now/CVE-2023-25150.md): Document content of files can be obtained through Collabora for files of other users (CVSS 5.8)
- [CVE-2023-23942](https://cve.now/CVE-2023-23942.md): Self reflected HTML injection in Desktop client (CVSS 5.4)
- [CVE-2023-23943](https://cve.now/CVE-2023-23943.md): Blind SSRF via server URL input in the Nextcloud Mail app (CVSS 5.0)
- [CVE-2023-23944](https://cve.now/CVE-2023-23944.md): Nexcloud Mail app temporarily stores cleartext password in database (CVSS 2.0)
- [CVE-2023-22471](https://cve.now/CVE-2023-22471.md): Nextcloud Deck vulnerable to authorization bypass (CVSS 3.5)
- [CVE-2023-22470](https://cve.now/CVE-2023-22470.md): Nextcloud Deck vulnerable to uncontrolled resource consumption (CVSS 3.5)
- [CVE-2023-22469](https://cve.now/CVE-2023-22469.md): Nextcloud Deck card vulnerable to data leak to unauthorized users via reference preview cache (CVSS 5.8)
- [CVE-2023-22473](https://cve.now/CVE-2023-22473.md): Passcode bypass on Talk-Android app (CVSS 2.1)
- [CVE-2023-22472](https://cve.now/CVE-2023-22472.md): Nextcloud Deck Desktop Client is vulnerable to Cross-Site Request Forgery (CSRF) via malicious link (CVSS 5.3)
- [CVE-2022-41971](https://cve.now/CVE-2022-41971.md): Nextcloud Talk guests can continue to receive video streams from call after being removed from a conversation (CVSS 4.8)
- [CVE-2022-41970](https://cve.now/CVE-2022-41970.md): Nextcloud Server's disabled download shares still allow download through preview images (CVSS 2.6)
- [CVE-2022-41969](https://cve.now/CVE-2022-41969.md): Nextcloud Server has no password length limit when creating a user as an administrator (CVSS 2.4)
- [CVE-2022-41968](https://cve.now/CVE-2022-41968.md): Nextcloud Server's calendar name length not validated before writing to database (CVSS 3.5)
- [CVE-2022-41926](https://cve.now/CVE-2022-41926.md): Nextcloud Talk Android broadcast incorrect permission handling (CVSS 3.3)
- [CVE-2022-39346](https://cve.now/CVE-2022-39346.md): Missing length validation of user displayname in nextcloud server (CVSS 3.5)
- [CVE-2022-39339](https://cve.now/CVE-2022-39339.md): Cleartext Transmission of Sensitive Information in user\_oidc (CVSS 4.3)
- [CVE-2022-39338](https://cve.now/CVE-2022-39338.md): Stored cross site scripting (XSS) vulnerability via Authorization Endpoint in user\_oidc (CVSS 3.5)
- [CVE-2022-39334](https://cve.now/CVE-2022-39334.md): nextcloudcmd incorrectly trusts bad TLS certificates (CVSS 3.9)
- [CVE-2022-39333](https://cve.now/CVE-2022-39333.md): Cross-site scripting (XSS) in Nextcloud Desktop Client (CVSS 4.6)
- [CVE-2022-39332](https://cve.now/CVE-2022-39332.md): Cross-site scripting (XSS) in Nextcloud Desktop Client (CVSS 4.6)
- [CVE-2022-39331](https://cve.now/CVE-2022-39331.md): Cross-site Scripting (XSS) in Nexcloud Desktop Client (CVSS 4.6)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/nextcloud
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.