Nextcloud Mail app does not respect download permissions in shares
Priority LOW 26CWE-284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-284.
Summary
Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. The Nextcloud mail app incorrectly allowed attaching shared files without download permissions as attachments. This allowed users to send them the files to themselves and then downloading it from their mail clients. It is recommended that the Nextcloud Mail is upgraded to 2.2.10, 3.6.2 or 3.7.2.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00539 45th percentileScored 2026-11-07
Fix Fixed security-advisories (nextcloud): 2.2.10, 3.6.2, 3.7.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| nextcloud | security-advisories | 2.2.0 to before 2.2.10; 3.6.0 to before 3.6.2; 3.7.0 to before 3.7.2 | 2.2.10, 3.6.2, 3.7.2 | Patch available | CNA |
- security-advisories Vendornextcloud Affected 2.2.0 to before 2.2.10; 3.6.0 to before 3.6.2; 3.7.0 to before 3.7.2 Fixed in 2.2.10, 3.6.2, 3.7.2 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nextcloud:mail:*:*:*:*:*:nextcloud:*:* | 2.2.0 to before 2.2.10; 3.6.0 to before 3.6.2; 3.7.0 to before 3.7.2 | Vulnerable | nextcloud |
- cpe:2.3:a:nextcloud:mail:*:*:*:*:*:nextcloud:*:* Versions 2.2.0 to before 2.2.10; 3.6.0 to before 3.6.2; 3.7.0 to before 3.7.2 Vulnerable ·nextcloud
Remediation
- Fix · CNA security-advisories (nextcloud) Fixed in 2.2.10, 3.6.2, 3.7.2
Timeline
- 2026-10-02 Threatist record created from CVE-2024-52509
References
More nextcloud Mail vulnerabilities
- TI-2023-09741 Blind SSRF via server URL input in the Nextcloud Mail app CVSS 3.1MEDIUM 5.0
- TI-2022-13176 Unauthenticated SSRF in 3rd party module "cerdic/csstidy" CVSS 3.1CRITICAL 9.8
- TI-2023-26170 Nextcloud Mail app vulnerable to Server-Side Request Forgery CVSS 3.1CRITICAL 9.8
- TI-2021-12320 Missing permission check on email metadata retrieval CVSS 3.1HIGH 8.8
- TI-2024-35179 Nextcloud Mail auto configurator can be tricked into sending account information to wrong servers CVSS 3.1HIGH 8.2
- TI-2020-06574 A missing verification of the TLS host in Nextcloud Mail 1.1.3 allowed a man in the middle attack. CVSS 3.1HIGH 7.0
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences