What’s Vulnerable › Vulnerabilities

CVE-2022-36074: Authentication headers exposed on by Nextcloud Server

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-09-15 · updated 2026-06-17
• Weakness: CWE-200

Description

Nextcloud server is an open source personal cloud product. Affected versions of this package are vulnerable to Information Exposure which fails to strip the Authorization header on HTTP downgrade. This can lead to account access exposure and compromise. It is recommended that the Nextcloud Server is upgraded to 23.0.7 or 24.0.3. It is recommended that the Nextcloud Enterprise Server is upgraded to 22.2.11, 23.0.7 or 24.0.3. There are no known workarounds for this issue.

Affected products

• Nextcloud Enterprise Server: before 22.2.11; from 23.0.0 before 23.0.7; from 24.0.0 before 24.0.3 — fixed in 22.2.11, 23.0.7, 24.0.3
• Nextcloud Server: before 23.0.7; from 24.0.0 before 24.0.3 — fixed in 23.0.7, 24.0.3

How to fix

Upgrade to a fixed version: Nextcloud Enterprise Server 22.2.11, 23.0.7, 24.0.3; Nextcloud Server 23.0.7, 24.0.3. Check the vendor advisory for mitigations.

References

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vqgm-f748-g76v
• https://github.com/nextcloud/server/pull/32941
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vqgm-f748-g76v
• https://github.com/nextcloud/server/pull/32941

Get alerted when CVE-2022-36074 or the next vulnerability affects your stack