CVE-2023-28647

App pin of the iOS app can be bypassed in Nextcloud iOS

State: Published
Severity: 4.4 Medium
Published: Mar 30, 2023
Updated: Feb 11, 2025
Reserved: Mar 20, 2023

Description

Nextcloud iOS is an ios application used to interface with the nextcloud home cloud ecosystem. In versions prior to 4.7.0 when an attacker has physical access to an unlocked device, they may enable the integration into the iOS Files app and bypass the Nextcloud pin/password protection and gain access to a users files. It is recommended that the Nextcloud iOS app is upgraded to 4.7.0. There are no known workarounds for this vulnerability.

Scores

CVSS	Score	Vector	Source
3.1	4.4 Medium	CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L	GitHub_M

Weaknesses

CWE-281 Improper Preservation of Permissions
CWE-287 Improper Authentication

Affected Products

Product	Versions
security-advisoriesnextcloud	< 4.7.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.