What’s Vulnerable › Vulnerabilities

CVE-2023-25821: Nextcloud download permissions can be changed by resharer

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-02-25 · updated 2026-06-17
• Weakness: CWE-284

Description

Nextcloud is an Open Source private cloud software. Versions 24.0.4 and above, prior to 24.0.7, and 25.0.0 and above, prior to 25.0.1, contain Improper Access Control. Secure view for internal shares can be circumvented if reshare permissions are also given. This issue is patched in versions 24.0.7 and 25.0.1. No workaround is available.

Affected products

• Nextcloud Server: from 24.0.4 before 24.0.7; 25.0.0 — fixed in 24.0.7

How to fix

Upgrade to a fixed version: Nextcloud Server 24.0.7. Check the vendor advisory for mitigations.

References

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7w6h-5qgw-4j94
• https://github.com/nextcloud/server/pull/34502
• https://hackerone.com/reports/1724016
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-7w6h-5qgw-4j94
• https://github.com/nextcloud/server/pull/34502
• https://hackerone.com/reports/1724016

Get alerted when CVE-2023-25821 or the next vulnerability affects your stack