CVE-2023-25160

IDOR Vulnerability in Nextcloud Mail

State: Published
Severity: 4.1 Medium
Published: Feb 13, 2023
Updated: Mar 10, 2025
Reserved: Feb 3, 2023

Description

Nextcloud Mail is an email app for the Nextcloud home server platform. Prior to versions 2.2.1, 1.14.5, 1.12.9, and 1.11.8, an attacker can access the mail box by ID getting the subjects and the first characters of the emails. Users should upgrade to Mail 2.2.1 for Nextcloud 25, Mail 1.14.5 for Nextcloud 22-24, Mail 1.12.9 for Nextcloud 21, or Mail 1.11.8 for Nextcloud 20 to receive a patch. No known workarounds are available.

Scores

CVSS	Score	Vector	Source
3.1	4.1 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N	GitHub_M

Weaknesses

CWE-639 Authorization Bypass Through User-Controlled Key

Affected Products

Product	Versions
security-advisoriesnextcloud	< 1.11.8Affected >= 1.12.0, < 1.12.9Affected >= 1.13.0, < 1.14.5Affected >= 2.0.0, < 2.2.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.