PT-2023-21871

CVE-2023-28646

Published

2023-03-30

Updated

2026-07-12

Description by

CVSS 3.1

4.4

Medium

MetricsAV:P/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Nextcloud Android versions 3.7.0 through 3.24.0

Description The Nextcloud Android app has a security issue that allows an attacker with access to an unlocked physical device to bypass the Pin/passcode protection using a third-party app. This enables the attacker to view meta information such as sharer, sharees, and activity of files.

Recommendations For versions 3.7.0 through 3.24.0, upgrade the Nextcloud Android app to version 3.24.1 to resolve the issue.

Exploitability

Exploit

Fix

Impacts

Researchers

Nickvergessen

Vendors

Affected products

Weakness enumeration

CWE-287: Improper Authentication

CWE-281: Improper Preservation of Permissions