CVE-2022-36075: nextcloud files_access_control
Vulnerability summary
CVE-2022-36075 is a medium (CVSS 4.3) vulnerability in nextcloud files_access_control. EPSS estimates a 0.57% chance of exploitation in the next 30 days, higher than 45.9% of scored vulnerabilities.
Timeline
- 15-09-2022PublishedVulnerability first disclosed.
- 23-04-2025Last modifiedVulnerability information updated.
Description
Nextcloud files access control is a nextcloud app to manage access control for files. Users with limited access can see file names in certain cases where they do not have privilege to do so. This issue has been addressed and it is recommended that the Nextcloud Files Access Control app is upgraded to 1.12.2, 1.13.1 or 1.14.1. There are no known workarounds for this issue
CVSS metrics
2 scores · 2 sources · 1 version- CVE.orgCNA2.6LowCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:NDiffers
EPSS trend
Probability
0.57%
Chance of exploitation in the next 30 days
Percentile
46%
Versus all other CVEs
30-day change
0.00 pp
From 0.56% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Affected systems
Nextcloud2 products
- files_access_control< 1.12.2 | 1.13.0 | 1.14.0
- security-advisories< 1.12.2 | ≥ 1.13.0, < 1.13.1 | ≥ 1.14.0, < 1.14.1
1 vendor · 2 products
References
2 links- github.com/nextcloud/security-advisories/security/advisories/GHSA-4m73-g7v7-v62wX Refsource CONFIRMThird Party Advisory