CVE-2019-15610

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Improper authorization in the Circles app 0.17.7 causes retaining access when an email address was removed from a circle.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-285

Affected software

VendorProductVersions
n/aNextcloud Circles17.0.7

References

Timeline

Published
Feb 4, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-156114.9Violation of Secure Design Principles in the iOS App 2.23.0 causes the app to leak its login and token to other Nextcloud services when searCVE-2019-156125.9A bug in Nextcloud Server 15.0.2 causes pending 2FA logins to not be correctly expired when the password of the user is reset.CVE-2019-156138.0A bug in Nextcloud Server 17.0.1 causes the workflow rules to depend their behaviour on the file extension when checking file mimetypes.CVE-2019-156145.4Missing sanitization in the iOS App 2.24.4 causes an XSS when opening malicious HTML files.CVE-2019-156156.1A wrong check for the system time in the Android App 3.9.0 causes a bypass of the lock protection when changing the time of the system to thCVE-2019-156164.3Dangling remote share attempts in Nextcloud 16 allow a DNS pollution when running long.CVE-2019-156175.4A missing check in Nextcloud Server 17.0.0 allowed an attacker to set up a new second factor when trying to login.CVE-2019-156184.8Missing escaping of HTML in the Updater of Nextcloud 15.0.5 allowed a reflected XSS when starting the updater from a malicious location.CVE-2019-156194.8Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud DecCVE-2019-156202.7Improper access control in Nextcloud Talk 6.0.3 leaks the existance and the name of private conversations when linked them to another sharedCVE-2019-156216.5Improper permissions preservation in Nextcloud Server 16.0.1 causes sharees to be able to reshare with write permissions when sharing the moCVE-2019-156222.4Not strictly enough sanitization in the Nextcloud Android app 3.6.0 allowed an attacker to get content information from protected tables whe
CVE-2019-15610: Medium severity, CVSS 4.3 | Vulnix