What’s Vulnerable › Vulnerabilities

CVE-2022-24886: Exposure of Sensitive Information to an Unauthorized Actor in com.nextcloud.client

• Severity: low (CVSS 3.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-04-27 · updated 2026-06-17
• Weakness: CWE-200

Description

Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. In versions prior to 3.19.0, any application with notification permission can access contacts if Nextcloud has access to Contacts without applying for the Contacts permission itself. Version 3.19.0 contains a fix for this issue. There are currently no known workarounds.

Affected products

• com.nextcloud.client: before 3.19.0 — fixed in 3.19.0

How to fix

Upgrade to a fixed version: com.nextcloud.client 3.19.0. Check the vendor advisory for mitigations.

References

• https://github.com/nextcloud/android/pull/9726
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5cj3-v98r-2wmq
• https://hackerone.com/reports/1161401
• https://github.com/nextcloud/android/pull/9726
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5cj3-v98r-2wmq
• https://hackerone.com/reports/1161401

Get alerted when CVE-2022-24886 or the next vulnerability affects your stack