CVE-2021-32678

Nextcloud Server vulnerability CVE-2021-32678 concerns missing rate limiting on OCS API responses for controllers using BruteForceProtection (OCSController). Affected versions before the patches allow bypassing authentication rate limits or spamming users, with risk depending on installed apps. T...

CVE-2023-25162

Nextcloud Server versions prior to 24.0.8 and 23.0.12 (and Nextcloud Enterprise Server prior to 24.0.8 and 23.0.12) are affected by an SSRF vulnerability that can bypass IP filtering using specialized payloads to read metadata when hosted on AWS. The issue is fixed in Nextcloud Server 24.0.8, 23....

CVE-2021-32734

CVE-2021-32734 affects Nextcloud Server where the Nextcloud Text application, prior to versions 19.0.13, 20.0.11, and 21.0.3, returned verbatim exception messages to users, potentially disclosing full paths of shared files. The issue was fixed in 19.0.13, 20.0.11, and 21.0.3. A workaround is to d...

CVE-2019-15623

CVE-2019-15623 affects Nextcloud Server (notably up to 16.0.1 in the description). The issue is an information disclosure where, when the Lookup Server is disabled, the server leaks its domain and user IDs to the Nextcloud Lookup Server. This is classified as a privacy exposure with partial confi...

CVE-2021-32741

CVE-2021-32741 : Nextcloud Server versions before 19.0.13, 20.0.11, and 21.0.3 lacked ratelimiting on the public share link mount endpoint, enabling enumeration of potentially valid share tokens. The issue is fixed in the corresponding updated releases (19.0.13, 20.0.11, 21.0.3). No public workar...

CVE-2020-8118

CVE-2020-8118 describes an authenticated server-side request forgery (SSRF) in Nextcloud Server 16.0.1 . The vulnerability exists in the calendar application’s “add new subscription” workflow and permits an attacker to detect local and remote services. The connected documents consistently identif...

CVE-2021-32703

Nextcloud Server CVE-2021-32703: The vulnerability is due to a lack of ratelimiting on the shareinfo endpoint, which could allow an attacker to enumerate potentially valid share tokens. Affected versions prior to 19.0.13, 20.0.11, and 21.0.3 are fixed in those respective versions. Remediation is ...

CVE-2020-8155

CVE-2020-8155 is addressed in Nextcloud security updates across multiple distributions. OpenSUSE and Fedora advisories show Nextcloud updates (e.g., openSUSE-2020-670, openSUSE-2020-0670-1, FEDORA_2020-C9863904DE/NASLs) that fix CVE-2020-8155. The openSUSE entries describe CVE-2020-8155 as a dire...

CVE-2021-32801

CVE-2021-32801 affects Nextcloud Server and concerns logging of potentially sensitive information in log files due to exception logging. The public records in OpenSUSE/GLSA summaries tie this CVE to Nextcloud Server components and indicate fixes were deployed in updated releases (Nextcloud 20.0.1...

CVE-2021-32725

CVE-2021-32725 concerns Nextcloud Server: in versions prior to 19.0.13, 20.0.11, and 21.0.3, default share permissions were not respected for federated reshares of files and folders. This could lead to unintended access control behavior across federated shares. The issue has been fixed in the res...

CVE-2020-8294

CVE-2020-8294 in Nextcloud Server is a missing link validation vulnerability that allowed stored XSS via a javascript: URL in markdown. Affected versions are Nextcloud Server before 20.0.2, 19.0.5, and 18.0.11. The issue is fixed in OpenSUSE/OpenSUSE-SU updates (e.g., Nextcloud 20.0.7 and later)....

CVE-2024-52517

CVE-2024-52517 affects Nextcloud Server (and Enterprise Server) where, after storing global credentials for external storage, the API returns them and injects them into the frontend, enabling plaintext read by someone with an active user session. This information disclosure risk is limited to use...

CVE-2026-45691

Summary: CVE-2026-45691 affects Nextcloud Server prior to 32.0.9 and 33.0.3, where a pre-2FA session cookie created after password auth but before TOTP could be reused as a Bearer token to access DAV endpoints, bypassing mandatory two-factor authentication and granting read/write access. Impact: ...

CVE-2021-32766

CVE-2021-32766 affects Nextcloud Text (bundled with Nextcloud Server). The issue: in affected versions, error messages differ based on whether a folder exists in a public File Drop share, allowing an attacker with a valid File Drop link to enumerate folders/files. Impact is information disclosure...

CVE-2021-41239

CVE-2021-41239 affects Nextcloud Server. The issue arises when the User Status API does not respect the administrator’s user enumeration settings, allowing a user to enumerate other users on the instance even if listings are disabled. The vulnerability is described in multiple connected sources a...

CVE-2023-25159

CVE-2023-25159 affects Nextcloud Server and related components. Technical details from PT Security show the issue resides in OCFilesNodeFolder::getFullPath(), where improper validation/normalization can allow crafted paths to escape a user’s space, potentially overwriting other users’ data. Affec...

CVE-2023-49791

CVE-2023-49791 affects Nextcloud Server and Nextcloud Enterprise Server where an attacker with an active session of another user could call the API to delete/modify workflows without password confirmation, bypassing the UI check. The description lists affected ranges: Nextcloud Server pre-26.0.9 ...

CVE-2024-52518

CVE-2024-52518 (Nextcloud Server) : A session takeover allows an attacker who gains access to a user or admin session to create, modify, or delete external storages without re-entering a password. Descriptions across multiple sources (NVD, Red Hat, GitHub advisories) confirm the issue affects Nex...

CVE-2025-47791

The vulnerability CVE-2025-47791 affects Nextcloud Server (self-hosted) and Nextcloud Enterprise Server prior to 28.0.13, 29.0.10, and 30.0.3. The issue is an improperly protected, currently unused endpoint used to verify a share recipient, which could proxy requests to another server. Affected v...

CVE-2023-39959

CVE-2023-39959 affects Nextcloud Server. Unauthenticated users could send a DAV request to determine whether a calendar or address book with a given identifier exists on victims’ accounts. Affected are Nextcloud Server versions prior to 25.0.9, 26.0.4, and 27.0.1 (and corresponding Enterprise Ser...

CVE-2022-41970

CVE-2022-41970 affects Nextcloud Server prior to 24.0.7 and 25.0.1, where disabled download shares could still be accessed via preview images. As a result, images could be downloaded and the first page of document previews could be downloaded without watermark, effectively bypassing intended prot...

CVE-2022-24888

Nextcloud Server vulnerability CVE-2022-24888 affects the file server component: prior to versions 20.0.14.4, 21.0.8, 22.2.4, and 23.0.1, it is possible to create files or folders whose names include leading or trailing control characters (\n, \r, \t, \v). The issue arises because the server filt...

CVE-2023-48301

Technical details about CVE-2023-48301 are not provided in the connected documents. The initial entry describes a link-injection fix in specific Nextcloud Server/Enterprise Server versions, but no explicit affected versions or remediation details are given in the supplied sources. Monitor for upd...

CVE-2023-48302

Nextcloud CVE-2023-48302 concerns rendering HTML code pasted via Ctrl+Shift+V, which could disclose markup to other users. Affected versions include Nextcloud Server and Enterprise Server up to 25.0.12/25.0.0–25.0.12, 26.0.x up to 26.0.7/26.0.8, and 27.1.x up to 27.1.2/27.1.3. The issue is fixed ...

CVE-2022-39211

CVE-2022-39211 corresponds to a Server-Side Request Forgery (SSRF) in Nextcloud Server caused by a filter/domain-check bypass that allows locally running web services to be discovered and requested. Affected versions include Nextcloud Server prior to 23.0.8 and 24.0.4, and Nextcloud Enterprise Se...

CVE-2022-39329

CVE-2022-39329 affects Nextcloud Server (and Enterprise Server) prior to versions 23.0.9 and 24.0.5, where information could be exposed without admin-controlled access and without database access. The issue is resolved by patches in 23.0.9 and 24.0.5, with no public workarounds reported. Affected...

CVE-2024-37884

CVE-2024-37884 concerns Nextcloud Server where a malicious user could send delete requests for old file versions that were shared with read permissions. The initial description specifies upgraded paths: Nextcloud Server should be updated to 26.0.12 or 27.1.7 or 28.0.3, and Nextcloud Enterprise Se...

CVE-2019-15617

CVE-2019-15617 affects Nextcloud Server (17.0.0) and arises from a missing check that allowed an attacker to set up a new second factor during login. Public documents reference the vulnerability and status across multiple sources (NVD/OSV/openvas) with remediation guidance generally recommending ...

CVE-2019-15612

Nextcloud Server 15.0.2 is affected by CVE-2019-15612, where 2FA sessions are not properly expired after a user password reset. The issue is described as a bug in Nextcloud Server 15.0.2 that leaves pending 2FA logins active after password changes. Public references include the NVD entry and the ...

CVE-2022-41968

Nextcloud Server vulnerability CVE-2022-41968: calendar name lengths were not validated before writing to the database, affecting versions prior to 23.0.10 and 24.0.5. Patches are available in 23.0.10 and 24.0.5; no public workarounds are documented. Connected advisories corroborate the issue as ...

CVE-2023-39958

CVE-2023-39958 affects Nextcloud Server where, in versions 22.0.0 through 22.2.x, 23.x, 24.x, 25.x, 26.x and 27.x, missing protection allowed brute-forcing of OAuth2 client secrets. The issue is mitigated by patches in Nextcloud Server: 25.0.9, 26.0.4, 27.0.1 and corresponding Enterprise Server p...

CVE-2017-0893

CVE-2017-0893 affects Nextcloud Server prior to 9.0.58, 10.0.5, and 11.0.3. A vulnerable JavaScript library used for sanitizing untrusted input enables a cross-site scripting (XSS) issue due to a Safari 10.1/10.2 behavior change. Nextcloud notes a strict Content-Security-Policy that mitigates exp...

CVE-2024-52521

The CVE records a vulnerability in Nextcloud Server where MD5 hashes were used to check background jobs for uniqueness, allowing a background job with specific arguments to be falsely identified as already existing and not queued. Technical details in connected documents confirm the root cause (M...

CVE-2022-31014

CVE-2022-31014 affects Nextcloud Server; SMTP command injection via iCalendar attachments through newline handling. Affected versions are Nextcloud Server up to 22.2.7/8, 23.x up to 23.0.5, and 24.x up to 24.0.1 (per sources). The root cause is insufficient sanitization of newline characters in S...

CVE-2018-16467

CVE-2018-16467 (Nextcloud Server before 14.0.0) is an improper access‑control vulnerability enabling unauthenticated attackers to bypass password protection for previews of single-file shares via the vulnerable publicpreview.php endpoint. The issue can disclose previews (notably image files) with...

CVE-2023-25161

CVE-2023-25161 affects Nextcloud Server (and Enterprise Server) with missing rate limiting on the password reset function prior to versions 25.0.1, 24.0.8, and 23.0.12. The root issue is lack of rate limiting, which can cause service slowdown, storage overflow, or cost impact when external email ...

CVE-2016-9467

CVE-2016-9467 involves content spoofing in the files app of Nextcloud Server and ownCloud Server. Affected versions: Nextcloud Server < 9.0.54 and 10.0.1; ownCloud Server

CVE-2017-0936

CVE-2017-0936 affects Nextcloud Server prior to 11.0.7 and 12.0.5, where an Authorization Bypass Through User-Controlled Key vulnerability exists due to a missing ownership check. This allows logged-in users to change the scope of app passwords for other users. The app passwords themselves are no...

CVE-2016-7419

Affected software and scope: CVE-2016-7419 is an XSS vulnerability in the share.js file of the gallery application used by ownCloud Server < 9.0.4 and Nextcloud Server

CVE-2017-0890

Nextcloud Server vulnerability CVE-2017-0890 is a DOM-based XSS in the search dialogue caused by inadequate escaping. Affects Nextcloud Server versions prior to 11.0.3. Exploitation requires a user to input or paste malicious content into the search dialogue. The issue is confirmed through multip...

CVE-2018-3776

CVE-2018-3776 affects Nextcloud Server; an improper input validator in affected versions prior to 12.0.3 and 11.0.5 could allow an attacker’s actions to bypass audit-logging. The vulnerability is documented across multiple sources (including Red Hat and OpenVAS feeds) and is described as a loggin...

CVE-2018-3780

CVE-2018-3780 detail (normal mode): Nextcloud’s autocomplete search results may expose a stored XSS due to missing sanitization in the autocomplete field. The flaw affects Nextcloud Server releases around 13.x (notably 13.0.5 and related updates) and can be triggered by crafted search results con...

CVE-2016-9465

CVE-2016-9465 affects Nextcloud Server < 10.0.1 and ownCloud Server

CVE-2020-8133

Nextcloud Server 19.0.1 vulnerability (CVE-2020-8133) arises from incorrect passphrase generation for the encrypted block, enabling an attacker to silently overwrite blocks within a file. Public sources (Nextcloud advisory NC-SA-2020-038) describe MAC-based encryption weaknesses that can be explo...

CVE-2026-45690

Nextcloud Server versions 32.0.0–32.0.9 and 33.0.0–33.0.3 expose an authentication bypass where, after valid credentials are entered on a 2FA-enabled account, a temporary session token is created before the second factor is enforced. The token can be extracted and replayed via HTTP Basic Authenti...

CVE-2016-9468

CVE-2016-9468 affects Nextcloud Server before 9.0.54 and 10.0.1 and ownCloud Server before 9.0.6 and 9.1.2. The vulnerability is a content spoofing issue in the dav app caused by an exception message that included partially user‑controllable input, potentially leading to misrepresentation of info...

CVE-2017-0891

Nextcloud Server (before 9.0.58, 10.0.5, and 11.0.3) is vulnerable to an inadequate escaping of error messages that leads to Reflected Cross-Site Scripting in multiple components. The provided documents designate this as CVE-2017-0891 and describe XSS in error handling; exploitation details are n...

CVE-2018-16465

Nextcloud Server is affected when used with versions prior to 14.0.0. The issue is a missing state that would have enforced a second factor at login if the 2FA provider failed to load, effectively allowing a 2FA bypass under certain conditions. This vulnerability is described in advisories NC-SA-...

CVE-2018-16464

CVE-2018-16464 affects Nextcloud Server prior to 14.0.0. A missing access check could allow continued access to password-protected link shares after the owner changes the password, enabling unauthorized access to shared resources. Remediation: upgrade to Nextcloud Server 14.0.0 or apply vendor ad...