CVE-2023-22473: nextcloud security-advisories Improper Access Control
Vulnerability summary
CVE-2023-22473 is a low (CVSS 2.1) Improper Access Control vulnerability in nextcloud security-advisories. EPSS estimates a 0.58% chance of exploitation in the next 30 days, higher than 46.4% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 09-01-2023PublishedVulnerability first disclosed.
- 10-03-2025Last modifiedVulnerability information updated.
Description
Talk-Android enables users to have video & audio calls through Nextcloud on Android. Due to passcode bypass, an attacker is able to access the user's Nextcloud files and view conversations. To exploit this the attacker needs to have physical access to the target's device. There are currently no known workarounds available. It is recommended that the Nextcloud Talk Android app is upgraded to 15.0.2.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST2.1LowCVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
EPSS trend
Probability
0.58%
Chance of exploitation in the next 30 days
Percentile
46%
Versus all other CVEs
30-day change
+0.02 pp
From 0.56% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (hackerone.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Nextcloud2 products
- security-advisories< 15.0.2
- talk< 15.0.2
1 vendor · 2 products
References
3 links- github.com/nextcloud/security-advisories/security/advisories/GHSA-wvr4-gc4c-6vmxX Refsource CONFIRMThird Party Advisory