CVE-2023-22471

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Broken access control allows a user to delete attachments of other users. There are currently no known workarounds. It is recommended that the Nextcloud Deck app is upgraded to 1.6.5 or 1.7.3 or 1.8.2.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
nextcloud	security-advisories	>= 1.60, < 1.6.5; >= 1.7.0, < 1.7.3; >= 1.8.0, < 1.8.2

References

https://github.com/nextcloud/deck/pull/4173Patch, Third Party Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2vw5-pfg6-3wm6Third Party Advisory
https://github.com/nextcloud/deck/pull/4173Patch, Third Party Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2vw5-pfg6-3wm6Third Party Advisory

Timeline

Published: Jan 14, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-224728.8Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. It is poss CVE-2023-224732.1Talk-Android enables users to have video & audio calls through Nextcloud on Android. Due to passcode bypass, an attacker is able to access t CVE-2023-224748.1Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server uses the request header CVE-2023-224756.1Canarytokens is an open source tool which helps track activity and actions on your network. A Cross-Site Scripting vulnerability was identif CVE-2023-224764.3Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions prior to 2.25.6, due to insufficient access-level checks, any log CVE-2023-224777.5Mercurius is a GraphQL adapter for Fastify. Any users of Mercurius until version 10.5.0 are subjected to a denial of service attack by sendi CVE-2023-224787.5KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been p CVE-2023-224796.5KubePi is a modern Kubernetes panel. A session fixation attack allows an attacker to hijack a legitimate user session, versions 1.6.3 and be CVE-2023-224809.8KubeOperator is an open source Kubernetes distribution focused on helping enterprises plan, deploy and operate production-level K8s clusters CVE-2023-224815.5FreshRSS is a self-hosted RSS feed aggregator. When using the greader API, the provided password is logged in clear in `users/_/log_api.txt`CVE-2023-224828.8Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions of Argo CD starting with v1.8.2 and prior to 2.3.13, 2.4.CVE-2023-224837.5cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. Versions prior to 0.29.0.gfm.7 are subject