What’s Vulnerable › Vulnerabilities

CVE-2024-37317: Nextcloud Notes app can be tricked into using a received share created before the user logged in

• Severity: medium (CVSS 4.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-06-14 · updated 2026-06-17
• Weakness: CWE-284

Description

The Nextcloud Notes app is a distraction free notes taking app for Nextcloud. If an attacker managed to share a folder called `Notes/` with a newly created user before they logged in, the Notes app would use that folder store the personal notes. It is recommended that the Nextcloud Notes app is upgraded to 4.9.3.

Affected products

• nextcloud Notes: from 4.6.0 before 4.9.3 — fixed in 4.9.3

How to fix

Upgrade to a fixed version: nextcloud Notes 4.9.3. Check the vendor advisory for mitigations.

References

• https://github.com/nextcloud/notes/pull/1260
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wfqv-cx85-7rjx
• https://hackerone.com/reports/2254151
• https://github.com/nextcloud/notes/pull/1260
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wfqv-cx85-7rjx
• https://hackerone.com/reports/2254151

Get alerted when CVE-2024-37317 or the next vulnerability affects your stack