CVE-2022-31131 Ownership check missing when updating or deleting mail attachments in Nextcloud mail

🗓️ 06 Jul 2022 17:55:14Reported by GoogleType

osv🔗 osv.dev👁 11 Views

Nextcloud mail app prior to 1.12.2 lacks user account ownership checks for mail attachments, potentially exposing attachments to incorrect system users. Upgrade to 1.12.2 recommended

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2022-31131	6 Jul 202222:14	–	circl
CNNVD	Nextcloud 授权问题漏洞	6 Jul 202200:00	–	cnnvd
CVE	CVE-2022-31131	6 Jul 202217:55	–	cve
Cvelist	CVE-2022-31131 Ownership check missing when updating or deleting mail attachments in Nextcloud mail	6 Jul 202217:55	–	cvelist
EUVD	EUVD-2022-52759	3 Oct 202520:07	–	euvd
Nextcloud	Ownership check missing when updating or deleting mail attachments	6 Jul 202217:18	–	nextcloud
Hacker One	Nextcloud: Ownership check missing when updating or deleting attachments	24 May 202212:53	–	hackerone
NVD	CVE-2022-31131	6 Jul 202218:15	–	nvd
Prion	Design/Logic Flaw	6 Jul 202218:15	–	prion
Positive Technologies	PT-2022-20551 · Nextcloud · Nextcloud Mail	6 Jul 202200:00	–	ptsecurity

Source	Link
github	www.github.com/nextcloud/mail/pull/6600/commits/6dd2527be8d4f6788b449c8a8f5577628b990605
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31131.json
github	www.github.com/nextcloud/security-advisories/security/advisories/GHSA-xhv7-5mhv-299j
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-31131
github	www.github.com/nextcloud/mail/pull/6600

10 Apr 2026 04:47Current

4.5Medium risk

Vulners AI Score4.5

CVSS 3.15.4

EPSS0.00153