CVE-2023-28647: App pin of the iOS app can be bypassed in Nextcloud iOS

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-03-30 · updated 2026-06-17
Weakness: CWE-281

Description

Nextcloud iOS is an ios application used to interface with the nextcloud home cloud ecosystem. In versions prior to 4.7.0 when an attacker has physical access to an unlocked device, they may enable the integration into the iOS Files app and bypass the Nextcloud pin/password protection and gain access to a users files. It is recommended that the Nextcloud iOS app is upgraded to 4.7.0. There are no known workarounds for this vulnerability.

Affected products

com.nextcloud.client: before 4.7.0 — fixed in 4.7.0

How to fix

Upgrade to a fixed version: com.nextcloud.client 4.7.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-28647 or the next vulnerability affects your stack