Nextcloud Nextcloud Server any version

Preview generation used third-party library not suited for user-generated content in Nextcloud server

Webauthn tokens not removed after user has been deleted

Nextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6 subnets in rate-limiting considerations. This could potentially result in an attacker bypassing rate-limit controls such as the Nextcloud brute-force protection.

Bruteforce protection can be bypassed with misconfigured proxy

Nextcloud Server DNS pin middleware can be tricked into DNS rebinding allowing SSRF

Attacker can obtain write access to any federated share/public link

Nextcloud Server password reset endpoint is not brute force protected

Scope of workflow operations is not validated in nextcloud server

Application specific tokens can change their own scope

Filenames not escaped by default in controllers using DownloadResponse

Improper Authentication in Nextcloud Server prior to version 12.0.3 would allow an attacker that obtained user credentials to bypass the 2 Factor Authentication.

Nextcloud user scoped external storage can be used to gather credentials of other users

Potential share collision for recipients when caching is enabled in nextcloud server

Unrestricted filenames for logo or favicon as admin in the theming settings in nextcloud server

Users can set up workflows using restricted and invisible system tags in Nextcloud

OAuth2 client_secret stored in plain text in the Nextcloud database

Nextcloud Server's brute force protection allows someone to send more requests than intended

Trusted servers exchange can be triggered by attacker

Nextcloud Server users can make external storage mount points inaccessible for other users

Nextcloud Server's OAuth2 client secrets were stored in a recoverable way

Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.1.2, 9.0.6, and 8.2.9 suffer from SMB User Authentication Bypass. Nextcloud/ownCloud include an optional and not by default enabled SMB authentication component that allows authenticating users against an SMB server. This backend is implemented in a way that tries to connect to a SMB server and if that succeeded consider the user logged-in. The backend did not properly take into account SMB servers that have any kind of anonymous auth configured. This is the default on SMB servers nowadays and allows an unauthenticated attacker to gain access to an account without valid credentials. Note: The SMB backend is disabled by default and requires manual configuration in the Nextcloud/ownCloud config file. If you have not configured the SMB backend then you're not affected by this vulnerability.

Bypass of Two Factor Authentication in Nextcloud server

Nextcloud Server before 12.0.8 and 13.0.3 suffer from improper authentication on the OAuth2 token endpoint. Missing checks potentially allowed handing out new tokens in case the OAuth2 client was partly compromised.

Rate-limits not working on instances without configured memory cache backend

A bug in Nextcloud Server 14.0.4 could expose more data in reshared link shares than intended by the sharer.

Improper revalidation of permissions in Nextcloud Server prior to 14.0.0, 13.0.6 and 12.0.11 lead to not accepting access restrictions by acess tokens.

Nextcloud system addressbooks can be modified by malicious trusted server

Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace the encryption keys.

Basic auth header on WebDAV requests is not brute-force protected in Nextcloud

Delete permissions are not saved when creating public share in Nextcloud server

Nextcloud Server can reshare read&share only folder with more permissions

Nextcloud: Cross-Account Calendar Takeover via Unauthorized Group-Member-Set Update

Missing password confirmation when creating app passwords

A bug in Nextcloud Server 17.0.1 causes the workflow rules to depend their behaviour on the file extension when checking file mimetypes.

Nextcloud Server and Enterprise Server missing brute force protection on password confirmation modal

An Insecure direct object reference vulnerability in Nextcloud Server 18.0.2 allowed an attacker to remote wipe devices of other users when sending a malicious request directly to the endpoint.

Users can delete external storage mount points

A logic error in Nextcloud Server 19.0.0 caused a plaintext storage of the share password when it was given on the initial create API call.

A wrong check in Nextcloud Server 19 and prior allowed to perform a denial of service attack when resetting the password for a user.

Lack of ratelimit on public DAV endpoint