CVE-2023-22469

CVE-2023-22469 affects Nextcloud Deck (Deck app for Nextcloud), where unauthorized users can access cached data when obtaining a reference preview for a Deck card to which they have no access. Root cause is leakage via the reference preview cache, enabling data exposure of another user’s cards. A...

CVE-2022-29159

CVE-2022-29159 affects Nextcloud Deck (Kanban tool for Nextcloud). In versions prior to 1.4.8, 1.5.6, and 1.6.1, an authenticated user can move stacks with cards from their own board to another user’s board (an IDOR-like issue). A patch exists in Deck versions 1.4.8, 1.5.6, and 1.6.1. Public deta...

CVE-2024-22213

CVE-2024-22213 affects Nextcloud Deck (kanban-style app) and enables cross-site scripting via HTML submitted as a comment. The root cause is untrusted HTML execution in the Deck comment flow, allowing malicious code to run in a user’s browser. Affected versions include Deck 1.9.x and 1.10.x lines...

CVE-2025-66557

Affected software: Nextcloud Deck plugin/app. Vulnerability: A bug in the permission logic allowed users with the "Can share" permission to modify the permissions of other recipients (non-owners). Versions impacted: Pre-1.14.6 and pre-1.15.2. Impact (as stated): Users could alter recipient permis...

CVE-2025-66548

The Nextcloud Deck app allows spoofing file extensions by using RTLO characters, causing a mismatch between the displayed and actual extension. Affected versions are prior to 1.12.7, 1.14.4, and 1.15.1; fixes are in 1.12.7, 1.14.4, and 1.15.1. Exploitation details are not provided in the supplied...