CVE-2023-22472: Nextcloud Deck Desktop Client is vulnerable to Cross-Site Request Forgery (CSRF) via malicious link

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-01-09 · updated 2026-06-17
Weakness: CWE-352

Description

Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. It is possible to make a user send any POST request with an arbitrary body given they click on a malicious deep link on a Windows computer. (e.g. in an email, chat link, etc). There are currently no known workarounds. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.2.

Affected products

Desktop Client: 3.6.1

References

https://github.com/nextcloud/desktop/pull/5106
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4gfv-xqpx-42qj
https://github.com/nextcloud/desktop/pull/5106
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4gfv-xqpx-42qj

Get alerted when CVE-2023-22472 or the next vulnerability affects your stack