CVE-2022-39329: nextcloud nextcloud_enterprise_server Improper Access Control
Vulnerability summary
CVE-2022-39329 is a medium (CVSS 5.3) Improper Access Control vulnerability in nextcloud nextcloud_enterprise_server. EPSS estimates a 0.67% chance of exploitation in the next 30 days, higher than 51.2% of scored vulnerabilities.
Timeline
- 27-10-2022PublishedVulnerability first disclosed.
- 23-04-2025Last modifiedVulnerability information updated.
Description
Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to versions 23.0.9 and 24.0.5 are vulnerable to exposure of information that cannot be controlled by administrators without direct database access. Versions 23.0.9 and 24.0.5 contains patches for this issue. No known workarounds are available.
CVSS metrics
2 scores · 2 sources · 1 version- CVE.orgCNA3.5LowCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:NDiffers
EPSS trend
Probability
0.67%
Chance of exploitation in the next 30 days
Percentile
51%
Versus all other CVEs
30-day change
+0.02 pp
From 0.65% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
- CWE-285Improper AuthorizationThe product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
- CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Affected systems
Nextcloud3 products
- nextcloud_enterprise_server< 23.0.9 | ≥ 24.0.0, < 24.0.5
- nextcloud_server< 23.0.9 | ≥ 24.0.0, < 24.0.5
- security-advisories< 23.0.9 | ≥ 24.0.0, < 24.0.5
1 vendor · 3 products
References
3 links- github.com/nextcloud/security-advisories/security/advisories/GHSA-8f3p-rcm5-mrg3Third Party Advisory