← Vulnerability feed

Vulnerability record · CVE-2023-35927 · published 23 June 2023

CVE-2023-35927: Nextcloud server improper access control vulnerability

Nextcloud · Nextcloud Server

NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 21.0.0 until 21.0.9.12, 22.0.0 until 22.2.10.12, 23.0.0 until 23.0.12.7, 24.0.0 until 24.0.12.2, 25.0.0 until 25.0.7, and 26.0.0 until 26.0.2, when two server are registered as trusted servers for each other and successfully exchanged the share secrets, the malicious server could modify or delete VCards in the system addressbook on the origin server. This would impact the available and shown information in certain places, such as the user search and avatar menu. If a manipulated user modifies their own data in the personal settings the entry is fixed again. Nextcloud Server n 25.0.7 and 26.0.2 and Nextcloud Enterprise Server 21.0.9.12, 22.2.10.12, 23.0.12.7, 24.0.12.2, 25.0.7, and 26.0.2 contain a patch for this issue. A workaround is available. Remove all trusted servers in the "Administration" > "Sharing" settings `…/index.php/settings/admin/sharing`. Afterwards, trigger a recreation of the local system addressbook with the following `occ dav:sync-system-addressbook`.

8.1 CVSS 3.1 High EPSS 0.80% · top 45.0% CWE-284 · Improper access control
8.1CVSS 3.1 base score
0.80%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 21.0.0 until 21.0.9.12, 22.0.0 until 22.2.10.12, 23.0.0 until 23.0.12.7, 24.0.0 until 24.0.12.2, 25.0.0 until 25.0.7, and 26.0.0 until 26.0.2, when two server are registered as trusted servers for each other and successfully exchanged the share secrets, the malicious server could modify or delete VCards in the system addressbook on the origin server. This would impact the available and shown information in certain places, such as the user search and avatar menu. If a manipulated user modifies their own data in the personal settings the entry is fixed again. Nextcloud Server n 25.0.7 and 26.0.2 and Nextcloud Enterprise Server 21.0.9.12, 22.2.10.12, 23.0.12.7, 24.0.12.2, 25.0.7, and 26.0.2 contain a patch for this issue. A workaround is available. Remove all trusted servers in the "Administration" > "Sharing" settings `…/index.php/settings/admin/sharing`. Afterwards, trigger a recreation of the local system addressbook with the following `occ dav:sync-system-addressbook`.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h7f7-535f-7q87 Vendor Advisory
https://github.com/nextcloud/server/pull/38247 Issue Tracking
https://hackerone.com/reports/1976754 Permissions Required
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h7f7-535f-7q87 Vendor Advisory
https://github.com/nextcloud/server/pull/38247 Issue Tracking
https://hackerone.com/reports/1976754 Permissions Required

Track CVE-2023-35927 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2023-49792Nextcloud server improper restriction of authentication attempts vulnerabilityNextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well…EPSS 1.0%9.8CVE-2023-48306Nextcloud server server-side request forgery (ssrf) vulnerabilityNextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6…EPSS 0.80%9.8CVE-2021-32802Nextcloud server inclusion from untrusted sphere vulnerabilityNextcloud server is an open source, self hosted personal cloud. Nextcloud supports rendering image previews for user provided file content. For some …EPSS 2.6%9.8CVE-2021-32726Nextcloud server improper authentication vulnerabilityNextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, webauthn tokens were not deleted…EPSS 1.8%9.8CVE-2021-22915Nextcloud server improper restriction of authentication attempts vulnerabilityNextcloud server before 19.0.11, 20.0.10, 21.0.2 is vulnerable to brute force attacks due to lack of inclusion of IPv6 subnets in rate-limiting consi…EPSS 1.7%9.1CVE-2023-35172Nextcloud server improper restriction of authentication attempts vulnerabilityNextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. In NextCloud Server version…EPSS 0.92%9.1CVE-2021-32654Nextcloud server insecure direct object reference vulnerabilityNextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an attacker is able to receive …EPSS 1.8%8.8CVE-2023-45151Nextcloud server cleartext storage of sensitive data vulnerabilityNextcloud server is an open source home cloud platform. Affected versions of Nextcloud stored OAuth2 tokens in plaintext which allows an attacker who…EPSS 0.48%

Source: NIST National Vulnerability Database (record CVE-2023-35927), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.