What’s Vulnerable › Vulnerabilities

CVE-2022-29163: Bypass of password requirements when sharing a folder via the Circles app in Nextcloud Server

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-05-20 · updated 2026-06-17
• Weakness: CWE-671

Description

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.6 and 23.0.3, a user can create a link that is not password protected even if the administrator requires links to be password protected. Versions 22.2.6 and 23.0.3 contain a patch for this issue. There are currently no known workarounds.

Affected products

• Nextcloud Server: before 22.2.6; from 23.0.0 before 23.0.3 — fixed in 22.2.6, 23.0.3

How to fix

Upgrade to a fixed version: Nextcloud Server 22.2.6, 23.0.3. Check the vendor advisory for mitigations.

References

• https://github.com/nextcloud/circles/pull/866
• https://github.com/nextcloud/circles/pull/926
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pwjv-h37v-c4fx
• https://hackerone.com/reports/1406926
• https://github.com/nextcloud/circles/pull/866
• https://github.com/nextcloud/circles/pull/926
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pwjv-h37v-c4fx
• https://hackerone.com/reports/1406926

Get alerted when CVE-2022-29163 or the next vulnerability affects your stack