Dorrajaouad

**Name of the Vulnerable Software and Affected Versions** Nextcloud versions 5.5.13 through 5.5.16 Nextcloud versions 6.2.0 through 6.2.2 **Description** An authenticated user can enumerate other users on the same instance. This is possible because sharing restrictions were not effectively applied to the Calendar app's endpoint used for suggesting attendees. **Recommendations** Update to version 5.5.17. Update to version 6.2.3.

**Name of the Vulnerable Software and Affected Versions** Nextcloud versions 4.3.0 through 5.2.6 **Description** A removed collaborator retains unauthorized read access to uploaded respondent files for an affected form. This access is limited to uploaded files for forms where the user previously possessed results access. **Recommendations** Update to version 5.2.7.

**Name of the Vulnerable Software and Affected Versions** Nextcloud Server versions 32.0.0 through 32.0.8 Nextcloud Server versions 33.0.0 through 33.0.2 Nextcloud Enterprise Server (affected versions not specified) **Description** An authentication bypass allows attackers who possess a user's password to circumvent two-factor authentication (2FA) protections. During the login process for a 2FA-enabled account, the system generates a temporary session token before the second factor challenge is enforced. This token can be extracted and replayed using HTTP Basic Authentication to gain unauthorized access to authenticated endpoints. **Recommendations** Upgrade Nextcloud Server versions 32.0.0 through 32.0.8 to 32.0.9. Upgrade Nextcloud Server versions 33.0.0 through 33.0.2 to 33.0.3. Upgrade Nextcloud Enterprise Server to 33.0.3, 32.0.9, 31.0.14.5, 30.0.17.9, or 29.0.16.16.

**Name of the Vulnerable Software and Affected Versions** Nextcloud Server versions 31.0.0 through 31.0.11 Nextcloud Server versions 32.0.0 through 32.0.2 Nextcloud Enterprise Server versions prior to 21.0.9.20 Nextcloud Enterprise Server versions prior to 22.2.10.35 Nextcloud Enterprise Server versions prior to 23.0.12.31 Nextcloud Enterprise Server versions prior to 24.0.12.30 Nextcloud Enterprise Server versions prior to 25.0.13.25 Nextcloud Enterprise Server versions prior to 26.0.13.22 Nextcloud Enterprise Server versions prior to 27.1.11.22 Nextcloud Enterprise Server versions prior to 28.0.14.13 Nextcloud Enterprise Server versions prior to 29.0.16.10 Nextcloud Enterprise Server versions prior to 30.0.17.5 Nextcloud Enterprise Server versions prior to 31.0.12 Nextcloud Enterprise Server versions prior to 32.0.3 **Description** A missing relation check allows authenticated users who have access to any file comment to read the content of all comments. **Recommendations** Upgrade Nextcloud Server versions 31.0.0 through 31.0.11 to 31.0.12. Upgrade Nextcloud Server versions 32.0.0 through 32.0.2 to 32.0.3. Upgrade Nextcloud Enterprise Server to 21.0.9.20. Upgrade Nextcloud Enterprise Server to 22.2.10.35. Upgrade Nextcloud Enterprise Server to 23.0.12.31. Upgrade Nextcloud Enterprise Server to 24.0.12.30. Upgrade Nextcloud Enterprise Server to 25.0.13.25. Upgrade Nextcloud Enterprise Server to 26.0.13.22. Upgrade Nextcloud Enterprise Server to 27.1.11.22. Upgrade Nextcloud Enterprise Server to 28.0.14.13. Upgrade Nextcloud Enterprise Server to 29.0.16.10. Upgrade Nextcloud Enterprise Server to 30.0.17.5. Upgrade Nextcloud Enterprise Server to 31.0.12. Upgrade Nextcloud Enterprise Server to 32.0.3.