PT-2025-21658

CVE-2025-47792

Published

2025-05-16

Updated

2026-04-29

Description by

CVSS 3.1

6.1

Medium

MetricsAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Nextcloud Desktop versions prior to 3.15

Description: The issue affects Nextcloud Desktop, allowing 3rd party applications to create link shares for almost all data via the socket API. These shares can then be sent to an external service.

Recommendations: For versions prior to 3.15, update to version 3.15 to resolve the issue. As a temporary workaround, consider restricting access to the socket API until the update is applied.

Exploitability

Exploit

Fix

Impacts

Researchers

Nickvergessen

Vendors

Affected products

Weakness enumeration

CWE-284: Improper Access Control

CWE-862: Missing Authorization

Related identifiers