CVE-2023-39963

CVE-2023-39963 affects Nextcloud Server: a missing password confirmation after stealing a session can allow an attacker to create app passwords for the victim in listed older branches (versions before patches 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.8/9, 24.0.12.5, 25.0.9, 26.0.4, 27.0.1; patch...

CVE-2021-32679

CVE-2021-32679 : In Nextcloud Server, filenames were not escaped by default in controllers using DownloadResponse prior to versions 19.0.13, 20.0.11, and 21.0.3. A user-supplied filename passed unsanitized could cause a downloaded file to have a benign extension while the content is executable, p...

CVE-2019-15613

CVE-2019-15613 affects Nextcloud Server 17.0.1, where a bug causes workflow rules to depend on the file extension when checking MIME types. This can impact all three security properties (confidentiality, integrity, availability) per CVSS metrics (NVD: AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H; base sco...

CVE-2021-32688

Nextcloud Server tokens with application-scoped permissions could escalate their own privileges due to a missing permission check. In versions prior to 19.0.13, 20.0.11, and 21.0.3, these tokens could self-elevate and gain filesystem access. The issue is addressed in the patched releases 19.0.13,...

CVE-2023-48239

Nextcloud Server vulnerable to an issue where a malicious user could update external storage, rendering it inaccessible for others. Affected: Nextcloud Server 25.0.0–25.0.12.x, 26.0.0–26.0.7.x, 27.0.x up to 27.1.2.x; Nextcloud Enterprise Server versions with corresponding prior branches. Patched ...

CVE-2021-32800

CVE-2021-32800 affects Nextcloud Server where an attacker can bypass Two Factor Authentication, gaining access with only a password or access to a WebAuthn device. The vulnerability impacts Nextcloud Server in affected releases and is mitigated by upgrading to versions 20.0.12, 21.0.4, or 22.1.0 ...

CVE-2023-25817

CVE-2023-25817 pertains to Nextcloud Server where versions 24.0.0 through 24.0.8 allow a user to escalate permissions and delete files they should only view or download. Root cause details are not explicitly provided in the initial document beyond the vulnerability description, but the fix is cle...

CVE-2023-45151

CVE-2023-45151 affects Nextcloud Server where OAuth2 tokens were stored in plaintext on affected installations. The root cause is storage of OAuth2 tokens in plaintext on the server, enabling an attacker with server access to potentially elevate privileges. Affected versions were addressed by upg...

CVE-2021-32656

CVE-2021-32656 affects Nextcloud Server’s federated share feature. Prior to versions 19.0.11, 20.0.10, and 21.0.2, an attacker could access basic information about users by exploiting a public federated link added by a legitimate server user. This occurs because Nextcloud can share registered use...

CVE-2024-37882

CVE-2024-37882 affects Nextcloud Server (and Enterprise Server per advisory) where a recipient of a share with read&share permissions could reshared the item with higher permissions. The NVD entry lists higher impact on confidentiality and integrity (C/H, I/H) but no availability impact, with net...

CVE-2018-3775

CVE-2018-3775 concerns Nextcloud Server prior to version 12.0.3, where an attacker with valid user credentials could bypass two‑factor authentication due to improper authentication. The NVD entry lists CVSSv3.1 impact as high (C/H/I/H/A/H) and CVSSv2 as medium (I/P, no confidentiality/availabilit...

CVE-2021-41177

The CVE-2021-41177 entry affects Nextcloud Server. The issue is that before versions 20.0.13, 21.0.5, and 22.2.0, Nextcloud did not implement a memory-cache backend for rate-limiting, so components using rate limits (e.g., AnonRateThrottle, UserRateThrottle) were not actually rate-limited on inst...

CVE-2023-32319

Nextcloud Server vulnerability CVE-2023-32319: Missing brute-force protection on WebDAV endpoints via basic auth allows credential brute-forcing when usernames are not emails (affects 24.0.0+; fixed in 24.0.11, 25.0.5, 26.0.0). Users should upgrade to these releases; no workarounds are documented.

CVE-2023-35927

The CVE-2023-35927 issue affects Nextcloud Server and Enterprise Server where two trusted servers exchange share secrets and an attacker could modify or delete VCards in the origin server’s system address book, impacting user search and avatar menus. The initial description lists affected lines f...

CVE-2024-52519

CVE-2024-52519 affects Nextcloud Server and Nextcloud Enterprise Server. The issue is that OAuth2 client secrets were stored in a recoverable form, enabling an attacker with access to a database backup and the Nextcloud config file to decrypt them. Public documentation in the provided sources rec...

CVE-2023-32320

CVE-2023-32320 affects Nextcloud Server and Enterprise Server where, under parallel requests, the system could ignore the configured request limit and process faulty requests beyond the limit, enabling brute-force-like access to protected details. Affected versions include Nextcloud Server 25.0.7...

CVE-2020-8121

Nextcloud Server 14.0.4 contains a bug where data could be exposed via reshared link shares beyond what the sharer intended. Evidence from multiple sources shows this could allow access to extended data in reshared links, including expired reshared links that still grant access to the full folder...

CVE-2023-28643

CVE-2023-28643 affects Nextcloud Server. When two shares with the same name are sent to the same recipient while a memory cache is enabled, the second share can overwrite the first instead of being renamed to “{name} (2)”. This is documented across multiple sources in the connected set and is mit...

CVE-2023-35928

CVE-2023-35928 affects Nextcloud Server and Enterprise Server prior to the patched versions. A user could abuse a functionality to access another user’s login credentials and take over the account. Affected ranges include Nextcloud Server 25.0.0–25.0.7 and 26.0.0–26.0.2; Enterprise Server 19.0.0–...

CVE-2016-9463

This CVE affects Nextcloud Server prior to 9.0.54 and 10.0.1 and ownCloud Server prior to 9.1.2, 9.0.6, and 8.2.9. The issue is an SMB authentication backend that, when enabled, authenticates against an SMB server and incorrectly treats a connection to an SMB server with anonymous authentication ...

CVE-2026-45281

CVE-2026-45281 affects Nextcloud Server versions 32.0.0–32.0.8 and 33.0.0–33.0.2. The issue stems from improper authorization in the calendar backend, requiring an authenticated attacker who knows another user’s principal URL. An authenticated user could potentially send a request to gain full ac...

CVE-2023-28833

CVE-2023-28833 affects Nextcloud Server’s theming feature where admins can upload a logo or favicon with unrestricted filenames, enabling overwriting files in the appdata directory. Root cause: lack of filename validation for logo/favicon uploads. Impact: potential data modification via file over...

CVE-2020-8259

Nextcloud Server 19.0.1 is affected by CVE-2020-8259 due to insufficient protection of server-side encryption keys, allowing an attacker to replace the encryption keys. Exploitation details are not provided in the connected docs; the issue is described as a vulnerability in the key protection mec...

CVE-2023-30539

Nextcloud Server/server family suffers an access control vulnerability where system tag based file access control or file retention rules can be abused to limit or grant access. Affected: Nextcloud Server, Enterprise Server, and related Files automated tagging app. Root cause: misapplied access c...

CVE-2018-3761

Nextcloud Server before 12.0.8 and 13.0.3 is affected by an improper authentication flaw at the OAuth2 token endpoint. The root cause is missing checks that could allow issuing new tokens if the OAuth2 client was partly compromised. Public disclosures reference CVE-2018-3761, with vendor advisori...

CVE-2018-16466

CVE-2018-16466 affects Nextcloud Server prior to 14.0.0, 13.0.6, and 12.0.11. The root cause is improper revalidation of permissions, which can cause access restrictions to be bypassed via access tokens. The issue is documented in NC-SA-2018-010 (vendor fix). Affected versions include Nextcloud S...