Ctulhu

Nextcloud Talk is a fully on-premises audio/video and chat communication service. When cron jobs were misconfigured, messages were not expired, and the API would still return them while they were hidden by the frontend code.

Nextcloud Mail is an email app for the Nextcloud home server platform. An attacker can access the mail box by ID, getting the subjects and the first characters of the emails.

The issue allows an attacker to bypass the passcode, gaining access to the user's Nextcloud files and conversations. This can be exploited with physical access to the target device.

Nextcloud Deck is a Kanban-style project and personal management tool for Nextcloud, similar to Trello. The full path of the application is exposed to unauthorized users.

The issue affects Nextcloud Talk, a video and audio conferencing app for Nextcloud, a self-hosted productivity platform. When sharing a Deck card in conversation, the metaData can be manipulated, allowing users to be tricked into opening arbitrary URLs.

Nextcloud talk is a self-hosting messaging service. In affected versions, an attacker is able to control the link of a geolocation preview in the Nextcloud Talk application due to a lack of validation on the link. This could result in an open-redirect, but required user interaction. This only affected users of the Android Talk client.

The issue concerns improper sanitization of HTML in directory names. This allows styling of the directory name in the header bar when using basic HTML.