CVE-2023-35928

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Nextcloud Server is a space for data storage on Nextcloud, a self-hosted productivity playform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 19.0.0 until 19.0.13.9, 20.0.0 until 20.0.14.14, 21.0.0 until 21.0.9.12, 22.0.0 until 22.2.10.12, 23.0.0 until 23.0.12.7, 24.0.0 until 24.0.12.2, 25.0.0 until 25.0.7, and 26.0.0 until 26.0.2, a user could use this functionality to get access to the login credentials of another user and take over their account. This issue has been patched in Nextcloud Server versions 25.0.7 and 26.0.2 and NextCloud Enterprise Server versions 19.0.13.9, 20.0.14.14, 21.0.9.12, 22.2.10.12, 23.0.12.7, 24.0.12.2, 25.0.7, and 26.0.2.

Three workarounds are available. Disable app files_external. Change config setting "Allow users to mount external storage" to disabled in "Administration" > "External storage" settings `…/index.php/settings/admin/externalstorages`. Change config setting to disallow users to create external storages in "Administration" > "External storage" settings `…/index.php/settings/admin/externalstorages` with the types FTP, Nextcloud, SFTP, and/or WebDAV.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-274

Affected software

No affected versions have been published.

Timeline

Published: Jun 23, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-359295.4Tuleap is a free and open source suite to improve management of software development and collaboration. Prior to version 14.10.99.4 of Tulea CVE-2023-35936.5Mattermost fails to properly validate markdown, allowing an attacker to crash the server via a specially crafted markdown input.CVE-2023-359305.3SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. An CVE-2023-359314.3Shescape is a simple shell escape library for JavaScript. An attacker may be able to get read-only access to environment variables. This bug CVE-2023-359328.8jcvi is a Python library to facilitate genome assembly, annotation, and comparative genomics. A configuration injection happens when user in CVE-2023-359337.5OPenFGA is an open source authorization/permission engine built for developers. OpenFGA versions v1.1.0 and prior are vulnerable to a DoS at CVE-2023-359348.2yt-dlp is a command-line program to download videos from video sites. During file downloads, yt-dlp or the external downloaders that yt-dlp CVE-2023-359365.0Pandoc is a Haskell library for converting from one markup format to another, and a command-line tool that uses this library. Starting in ve CVE-2023-359378.8Metersphere is an open source continuous testing platform. In versions prior to 2.10.2 LTS, some key APIs in Metersphere lack permission che CVE-2023-359387.2Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. When switching from a project visibil CVE-2023-359398.1GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on CVE-2023-359407.5GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on