CVE-2023-28646

App lockout in nextcloud Android app can be bypassed via thirdparty apps

State: Published
Severity: 4.4 Medium
Published: Mar 30, 2023
Updated: Feb 11, 2025
Reserved: Mar 20, 2023

Description

Nextcloud android is an android app for interfacing with the nextcloud home server ecosystem. In versions from 3.7.0 and before 3.24.1 an attacker that has access to the unlocked physical device can bypass the Nextcloud Android Pin/passcode protection via a thirdparty app. This allows to see meta information like sharer, sharees and activity of files. It is recommended that the Nextcloud Android app is upgraded to 3.24.1. There are no known workarounds for this vulnerability.

Scores

CVSS	Score	Vector	Source
3.1	4.4 Medium	CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L	GitHub_M

Weaknesses

CWE-287 Improper Authentication
CWE-281 Improper Preservation of Permissions

Affected Products

Product	Versions
security-advisoriesnextcloud	>= 3.7.0, < 3.24.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.