What’s Vulnerable › Products

nextcloud Mail vulnerabilities

15 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 3 published in the last 12 months.

Check whether your nextcloud Mail version is affected

Latest nextcloud Mail vulnerabilities

• CVE-2025-66514 — Nextcloud Mail stored HTML injection in subject text (CVSS 5.4)
• CVE-2024-52509 — Nextcloud Mail app does not respect download permissions in shares (CVSS 5.7)
• CVE-2024-52508 — Nextcloud Mail auto configurator can be tricked into sending account information to wrong servers (CVSS 8.1)
• CVE-2023-48307 — Nextcloud Mail app vulnerable to Server-Side Request Forgery (CVSS 9.8)
• CVE-2023-45660 — Require strict cookies for image proxy requests in Nextcloud Mail (CVSS 4.3)
• CVE-2023-33184 — Blind SSRF in the Nextcloud Mail app on avatar endpoint (CVSS 5.3)
• CVE-2023-25160 — IDOR Vulnerability in Nextcloud Mail (CVSS 5.3)
• CVE-2023-23943 — Blind SSRF via server URL input in the Nextcloud Mail app (CVSS 4.3)
• CVE-2023-23944 — Nexcloud Mail app temporarily stores cleartext password in database (CVSS 6.5)
• CVE-2022-31119 — Password disclosure in log file in Nextcloud Mail App (CVSS 4.9)
• CVE-2022-31132 — Unauthenticated SSRF in 3rd party module "cerdic/csstidy" (CVSS 9.8)
• CVE-2021-39220 — Bypass of image blocking in Nextcloud Mail (CVSS 3.5)
• CVE-2021-32707 — Bypass of image blocking in Nextcloud Mail (CVSS 4.3)
• CVE-2021-32652 — Missing permission check on email metadata retrieval (CVSS 4.3)
• CVE-2020-8156 — (CVSS 7.0)