CVE-2024-22402: nextcloud guests Improper Preservation of Permissions
Vulnerability summary
CVE-2024-22402 is a medium (CVSS 5.4) Improper Preservation of Permissions vulnerability in nextcloud guests. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 42.2% of scored vulnerabilities.
Timeline
- 18-01-2024PublishedVulnerability first disclosed.
- 09-06-2025Last modifiedVulnerability information updated.
Description
Nextcloud guests app is a utility to create guest users which can only see files shared with them. In affected versions users were able to load the first page of apps they were actually not allowed to access. Depending on the selection of apps installed this may present a permissions bypass. It is recommended that the Guests app is upgraded to 2.4.1, 2.5.1 or 3.0.1. There are no known workarounds for this vulnerability.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS trend
Probability
0.51%
Chance of exploitation in the next 30 days
Percentile
42%
Versus all other CVEs
30-day change
0.00 pp
From 0.51% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Nextcloud2 products
- guests< 2.4.1 | 2.5.0 | 3.0.0
- security-advisories≥ 2.4.0, < 2.4.1 | ≥ 2.5.0, < 2.5.1 | ≥ 3.0.0, < 3.0.1
1 vendor · 2 products
References
3 links- github.com/nextcloud/security-advisories/security/advisories/GHSA-v3qw-7vgv-2fxjX Refsource CONFIRMVendor Advisory