CVE-2023-35927

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 21.0.0 until 21.0.9.12, 22.0.0 until 22.2.10.12, 23.0.0 until 23.0.12.7, 24.0.0 until 24.0.12.2, 25.0.0 until 25.0.7, and 26.0.0 until 26.0.2, when two server are registered as trusted servers for each other and successfully exchanged the share secrets, the malicious server could modify or delete VCards in the system addressbook on the origin server. This would impact the available and shown information in certain places, such as the user search and avatar menu. If a manipulated user modifies their own data in the personal settings the entry is fixed again.

Nextcloud Server n 25.0.7 and 26.0.2 and Nextcloud Enterprise Server 21.0.9.12, 22.2.10.12, 23.0.12.7, 24.0.12.2, 25.0.7, and 26.0.2 contain a patch for this issue. A workaround is available. Remove all trusted servers in the "Administration" > "Sharing" settings `…/index.php/settings/admin/sharing`. Afterwards, trigger a recreation of the local system addressbook with the following `occ dav:sync-system-addressbook`.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Jun 23, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-359288.8Nextcloud Server is a space for data storage on Nextcloud, a self-hosted productivity playform. In NextCloud Server versions 25.0.0 until 25 CVE-2023-359295.4Tuleap is a free and open source suite to improve management of software development and collaboration. Prior to version 14.10.99.4 of Tulea CVE-2023-35936.5Mattermost fails to properly validate markdown, allowing an attacker to crash the server via a specially crafted markdown input.CVE-2023-359305.3SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. An CVE-2023-359314.3Shescape is a simple shell escape library for JavaScript. An attacker may be able to get read-only access to environment variables. This bug CVE-2023-359328.8jcvi is a Python library to facilitate genome assembly, annotation, and comparative genomics. A configuration injection happens when user in CVE-2023-359337.5OPenFGA is an open source authorization/permission engine built for developers. OpenFGA versions v1.1.0 and prior are vulnerable to a DoS at CVE-2023-359348.2yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp CVE-2023-359365.0Pandoc is a Haskell library for converting from one markup format to another, and a command-line tool that uses this library. Starting in ve CVE-2023-359378.8Metersphere is an open source continuous testing platform. In versions prior to 2.10.2 LTS, some key APIs in Metersphere lack permission che CVE-2023-359387.2Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. When switching from a project visibil CVE-2023-359398.1GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on