App pin of the Android app can be bypassed via thirdparty apps generating deep links

Description

Impact

An attacker that has access to the unlocked physical device can bypass the Nextcloud Android Pin protection via a thirdparty app. This allows to see meta information like sharer, sharees and activity of files.

Patches

It is recommended that the Nextcloud Android app is upgraded to 3.24.1

Workarounds

• No workaround available

References

• HackerOne
• PullRequest

For more information

If you have any questions or comments about this advisory:

• Create a post in nextcloud/security-advisories
• Customers: Open a support ticket at support.nextcloud.com