CVE-2023-26482

CVE-2023-26482 affects Nextcloud Server (24.x prior to 24.0.10 and 25.x prior to 25.0.4 in several sources). The issue is a missing scope validation for Workflow operations, allowing creation of workflows intended for admins to be usable by non-admin contexts and, in combination with certain apps...

CVE-2021-32726

Summary (CVE-2021-32726) Nextcloud Server versions prior to 19.0.13, 20.0.11, and 21.0.3 did not delete webauthn tokens after a user was deleted, allowing a previously used username to gain access to that account. The issue has been fixed in 19.0.13, 20.0.11, and 21.0.3. There are no known workar...

CVE-2023-49792

CVE-2023-49792 affects Nextcloud Server and Enterprise Server. When a trusted proxy is configured, the server may read an attacker’s remote address incorrectly, enabling authentication attempts to be misdirected. Affected versions include Nextcloud Server prior to 26.0.9, 27.1.4 and Nextcloud Ent...

CVE-2023-48306

CVE-2023-48306 affects Nextcloud Server and Nextcloud Enterprise Server due to a DNS pin middleware vulnerability that enables DNS rebinding and SSRF. The issue is fixed in Nextcloud Server in versions 25.0.11, 26.0.6, and 27.1.0, and in Nextcloud Enterprise Server in 22.2.10.16, 23.0.12.11, 24.0...

CVE-2023-35172

Technical details about CVE-2023-35172 are not publicly provided in the supplied documents. Monitor for updates from vendors and security advisories.

CVE-2021-32654

CVE-2021-32654 affects Nextcloud Server prior to versions 19.0.11, 20.0.10, and 21.0.2, allowing an attacker to obtain write/read privileges on any Federated File Share (including public links). Public links can be added as federated shares, enabling exploitation on those links. Upgrading to patc...

CVE-2021-22915

Concrete details from connected documents indicate CVE-2021-22915 affects Nextcloud server versions up to 19.0.11, 20.0.10, 21.0.2, due to IPv6 subnets not being included in rate-limiting for brute-force protection. The vulnerability allows bypassing rate-limit protections, with impact described ...