IDOR Vulnerability in Nextcloud Mail
Priority LOW 24CWE-639Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-639.
Summary
Nextcloud Mail is an email app for the Nextcloud home server platform. Prior to versions 2.2.1, 1.14.5, 1.12.9, and 1.11.8, an attacker can access the mail box by ID getting the subjects and the first characters of the emails. Users should upgrade to Mail 2.2.1 for Nextcloud 25, Mail 1.14.5 for Nextcloud 22-24, Mail 1.12.9 for Nextcloud 21, or Mail 1.11.8 for Nextcloud 20 to receive a patch. No known workarounds are available.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0046 40th percentileScored 2026-11-07
Fix Fixed security-advisories (nextcloud): 1.11.8, 1.12.9, 1.14.5 +1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| nextcloud | security-advisories | before 1.11.8; 1.12.0 to before 1.12.9; 1.13.0 to before 1.14.5; 2.0.0 to before 2.2.1 | 1.11.8, 1.12.9, 1.14.5, 2.2.1 | Patch available | CNA |
- security-advisories Vendornextcloud Affected before 1.11.8; 1.12.0 to before 1.12.9; 1.13.0 to before 1.14.5; 2.0.0 to before 2.2.1 Fixed in 1.11.8, 1.12.9, 1.14.5, 2.2.1 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nextcloud:mail:*:*:*:*:*:*:*:* | before 1.11.8; 1.12.0 to before 1.12.9; 1.13.0 to before 1.14.5; 2.0.0 to before 2.2.1 | Vulnerable | nextcloud |
- cpe:2.3:a:nextcloud:mail:*:*:*:*:*:*:*:* Versions before 1.11.8; 1.12.0 to before 1.12.9; 1.13.0 to before 1.14.5; 2.0.0 to before 2.2.1 Vulnerable ·nextcloud
Remediation
- Fix · CNA security-advisories (nextcloud) Fixed in 1.11.8, 1.12.9, 1.14.5, 2.2.1
Timeline
- 2026-10-02 Threatist record created from CVE-2023-25160
References
More nextcloud Mail vulnerabilities
- TI-2023-09741 Blind SSRF via server URL input in the Nextcloud Mail app CVSS 3.1MEDIUM 5.0
- TI-2022-13176 Unauthenticated SSRF in 3rd party module "cerdic/csstidy" CVSS 3.1CRITICAL 9.8
- TI-2023-26170 Nextcloud Mail app vulnerable to Server-Side Request Forgery CVSS 3.1CRITICAL 9.8
- TI-2021-12320 Missing permission check on email metadata retrieval CVSS 3.1HIGH 8.8
- TI-2024-35179 Nextcloud Mail auto configurator can be tricked into sending account information to wrong servers CVSS 3.1HIGH 8.2
- TI-2020-06574 A missing verification of the TLS host in Nextcloud Mail 1.1.3 allowed a man in the middle attack. CVSS 3.1HIGH 7.0
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences