What’s Vulnerable › Vulnerabilities

CVE-2022-31119: Password disclosure in log file in Nextcloud Mail App

• Severity: medium (CVSS 4.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-08-04 · updated 2026-06-17
• Weakness: CWE-532

Description

Nextcloud Mail is an email application for the nextcloud personal cloud product. Affected versions of Nextcloud mail would log user passwords to disk in the event of a misconfiguration. Should an attacker gain access to the logs complete access to affected accounts would be obtainable. It is recommended that the Nextcloud Mail is upgraded to 1.12.1. Operators should inspect their logs and remove passwords which have been logged. There are no workarounds to prevent logging in the event of a misconfiguration.

Affected products

• nextcloud Mail: before 1.12.1 — fixed in 1.12.1

How to fix

Upgrade to a fixed version: nextcloud Mail 1.12.1. Check the vendor advisory for mitigations.

References

• https://github.com/nextcloud/mail/issues/823
• https://github.com/nextcloud/mail/pull/6488/commits/ab9ade57fbc1f465ffe905248f93f328d638d7e5
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-63m3-w68h-3wjg
• https://github.com/nextcloud/mail/issues/823
• https://github.com/nextcloud/mail/pull/6488/commits/ab9ade57fbc1f465ffe905248f93f328d638d7e5
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-63m3-w68h-3wjg

Get alerted when CVE-2022-31119 or the next vulnerability affects your stack