What’s Vulnerable › Vulnerabilities

CVE-2023-25160: IDOR Vulnerability in Nextcloud Mail

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-02-13 · updated 2026-06-17
• Weakness: CWE-639

Description

Nextcloud Mail is an email app for the Nextcloud home server platform. Prior to versions 2.2.1, 1.14.5, 1.12.9, and 1.11.8, an attacker can access the mail box by ID getting the subjects and the first characters of the emails. Users should upgrade to Mail 2.2.1 for Nextcloud 25, Mail 1.14.5 for Nextcloud 22-24, Mail 1.12.9 for Nextcloud 21, or Mail 1.11.8 for Nextcloud 20 to receive a patch. No known workarounds are available.

Affected products

• nextcloud Mail: before 1.11.8; from 1.12.0 before 1.12.9; from 1.13.0 before 1.14.5; from 2.0.0 before 2.2.1 — fixed in 1.11.8, 1.12.9, 1.14.5, 2.2.1

How to fix

Upgrade to a fixed version: nextcloud Mail 1.11.8, 1.12.9, 1.14.5, 2.2.1. Check the vendor advisory for mitigations.

References

• https://github.com/nextcloud/mail/pull/7740
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m45f-r5gh-h6cx
• https://hackerone.com/reports/1784681
• https://github.com/nextcloud/mail/pull/7740
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m45f-r5gh-h6cx
• https://hackerone.com/reports/1784681

Get alerted when CVE-2023-25160 or the next vulnerability affects your stack