CVE-2023-49791: nextcloud nextcloud_server Improper Access Control
Vulnerability summary
CVE-2023-49791 is a medium (CVSS 5.4) Improper Access Control vulnerability in nextcloud nextcloud_server. EPSS estimates a 0.61% chance of exploitation in the next 30 days, higher than 48% of scored vulnerabilities.
Timeline
- 22-12-2023PublishedVulnerability first disclosed.
- 12-09-2024Last modifiedVulnerability information updated.
Description
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when an attacker manages to get access to an active session of another user via another way, they could delete and modify workflows by sending calls directly to the API bypassing the password confirmation shown in the UI. Nextcloud Server versions 26.0.9 and 27.1.4 and Nextcloud Enterprise Server versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4 contain a patch for this issue. No known workarounds are available.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
EPSS trend
Probability
0.61%
Chance of exploitation in the next 30 days
Percentile
48%
Versus all other CVEs
30-day change
0.00 pp
From 0.61% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Nextcloud2 products
- nextcloud_server≥ 23.0.0, < 23.0.12.13 | ≥ 24.0.0, < 24.0.12.9 | ≥ 25.0.0, < 25.0.13.4 | ≥ 26.0.0, < 26.0.9 | ≥ 27.0.0, < 27.1.4
- security-advisories≥ 23.0.0, < 23.0.12.13 | ≥ 24.0.0, < 24.0.12.9 | ≥ 25.0.0, < 25.0.13.4 | ≥ 26.0.0, < 26.0.9 | ≥ 27.0.0, < 27.1.4
1 vendor · 2 products
References
3 links- github.com/nextcloud/security-advisories/security/advisories/GHSA-3f8p-6qww-2prrX Refsource CONFIRMVendor Advisory