CVE-2023-49791

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when an attacker manages to get access to an active session of another user via another way, they could delete and modify workflows by sending calls directly to the API bypassing the password confirmation shown in the UI. Nextcloud Server versions 26.0.9 and 27.1.4 and Nextcloud Enterprise Server versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4 contain a patch for this issue. No known workarounds are available.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-284 CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Dec 22, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-497929.8Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4 CVE-2023-497936.5CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Zip files uploaded to CVE-2023-497947.8KernelSU is a Kernel-based root solution for Android devices. In versions 0.7.1 and prior, the logic of get apk path in KernelSU kernel modu CVE-2023-497955.3MindsDB connects artificial intelligence models to real time data. Versions prior to 23.11.4.1 contain a server-side request forgery vulnera CVE-2023-497965.3MindsDB connects artificial intelligence models to real time data. Versions prior to 23.11.4.1 contain a limited file write vulnerability in CVE-2023-497977.8PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a priv CVE-2023-497987.5OpenZeppelin Contracts is a library for smart contract development. A merge issue when porting the 5.0.1 patch to the 4.9 branch caused a li CVE-2023-497997.5`nuxt-api-party` is an open source module to proxy API requests. nuxt-api-party attempts to check if the user has passed an absolute URL to CVE-2023-49805.4Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 23.9.0.CVE-2023-498007.5`nuxt-api-party` is an open source module to proxy API requests. The library allows the user to send many options directly to `ofetch`. Ther CVE-2023-498017.5Lif Auth Server is a server for validating logins, managing information, and account recovery for Lif Accounts. The issue relates to the `ge CVE-2023-498026.1The LinkedCustomFields plugin for MantisBT allows users to link values between two custom fields, creating linked drop-downs. Prior to versi