Nextcloud Notes app can be tricked into using a received share created before the user logged in
Priority LOW 21CWE-284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-284.
Summary
The Nextcloud Notes app is a distraction free notes taking app for Nextcloud. If an attacker managed to share a folder called `Notes/` with a newly created user before they logged in, the Notes app would use that folder store the personal notes. It is recommended that the Nextcloud Notes app is upgraded to 4.9.3.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00312 24th percentileScored 2026-11-07
Fix Fixed security-advisories (nextcloud): 4.9.3
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA security-advisories (nextcloud) Fixed in 4.9.3
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2024-37317
References
More nextcloud Notes vulnerabilities
- TI-2023-20848 Notes attachment render HTML in preview mode CVSS 3.1MEDIUM 6.1
Sources
- CVE-2024-37317 · CVE Program
- CVE-2024-37317 · NVD
- FIRST EPSS
- CVE-2024-37317 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences