Ownership check missing when updating or deleting mail attachments

Description

Impact

An attacker is able to overwrite the local_message_id for draft attachments or delete them, making it unavailable for the actual sender in both cases. It is not possible to send the attachment to another user or to access it.

Patches

It is recommended that the Nextcloud Mail app is upgraded to 1.12.2 .

Workarounds

No workaround available

References

• Pull request
• HackerOne

For more information

If you have any questions or comments about this advisory:

• Create a post in nextcloud/security-advisories
• Customers: Open a support ticket at support.nextcloud.com