TI-2023-13165 Aliases CVE-2023-28647

App pin of the iOS app can be bypassed in Nextcloud iOS

LOW 30CWE-281Published 2023-03-30 · Updated 2025-02-11

Key facts

Attack vector: Physical
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-287.

Summary

Nextcloud iOS is an ios application used to interface with the nextcloud home cloud ecosystem. In versions prior to 4.7.0 when an attacker has physical access to an unlocked device, they may enable the integration into the iOS Files app and bypass the Nextcloud pin/password protection and gain access to a users files. It is recommended that the Nextcloud iOS app is upgraded to 4.7.0. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00278 20th percentileScored 2026-11-07

Fix Fixed security-advisories (nextcloud): 4.7.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
nextcloud	security-advisories	before 4.7.0	4.7.0	Patch available	CNA

security-advisories Vendornextcloud Affected before 4.7.0 Fixed in 4.7.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:nextcloud:nextcloud::::::iphone_os::*	before 4.7.0	Vulnerable	nextcloud

cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:iphone_os:*:* Versions before 4.7.0 Vulnerable ·nextcloud

Remediation

Fix · CNA security-advisories (nextcloud) Fixed in 4.7.0

Timeline

2026-10-02 Threatist record created from CVE-2023-28647

References

Patch 1

https://github.com/nextcloud/ios/pull/2344

Advisory 1

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wjgg-2v4p-2gq6

TI-2022-11704 Sensitive files/data exist after deletion of user account in Nextcloud Android CVSS 3.1LOW 3.3
TI-2022-08695 Improper Authentication in Nextcloud Android Files CVSS 3.1LOW 2.4
TI-2019-03862 SQL injection in com.nextcloud.client CVSS 3.1CRITICAL 9.8
TI-2021-19669 SQL Injection in FileContentProvider (GHSL-2021-1007) CVSS 3.1HIGH 7.5
TI-2023-13460 Nextcloud: Lack of authenticity of metadata keys allows a malicious server to gain access to E2EE folders CVSS 3.1MEDIUM 6.9
TI-2021-12395 End-to-end encryption device setup did not verify public key CVSS 3.1HIGH 7.5

See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences