What’s Vulnerable › Vulnerabilities

CVE-2022-39329: Profile of disabled user stays accessible

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-10-27 · updated 2026-06-17
• Weakness: CWE-284

Description

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Nextcloud Server and Nextcloud Enterprise Server prior to versions 23.0.9 and 24.0.5 are vulnerable to exposure of information that cannot be controlled by administrators without direct database access. Versions 23.0.9 and 24.0.5 contains patches for this issue. No known workarounds are available.

Affected products

• Nextcloud Enterprise Server: before 23.0.9; from 24.0.0 before 24.0.5 — fixed in 23.0.9, 24.0.5
• Nextcloud Server: before 23.0.9; from 24.0.0 before 24.0.5 — fixed in 23.0.9, 24.0.5

How to fix

Upgrade to a fixed version: Nextcloud Enterprise Server 23.0.9, 24.0.5; Nextcloud Server 23.0.9, 24.0.5. Check the vendor advisory for mitigations.

References

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8f3p-rcm5-mrg3
• https://github.com/nextcloud/server/pull/33643
• https://hackerone.com/reports/1675014
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8f3p-rcm5-mrg3
• https://github.com/nextcloud/server/pull/33643
• https://hackerone.com/reports/1675014

Get alerted when CVE-2022-39329 or the next vulnerability affects your stack