Vulnerabilities

TI-2025-40936 CVE-2025-66514

Nextcloud Mail stored HTML injection in subject text

LOW 24

Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00268 Published 2025-12-05 Fixed in 5.5.3 CWE-79

TI-2024-35180 CVE-2024-52509

Nextcloud Mail app does not respect download permissions in shares

LOW 26

Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform.

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.00539 Published 2024-11-15 Fixed in 2.2.10, 3.6.2 +1 CWE-284

TI-2024-35179 CVE-2024-52508

Nextcloud Mail auto configurator can be tricked into sending account information to wrong servers

LOW 39

Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform.

CVSS 3.1HIGH 8.2 Network No auth User interaction EPSS 0.0075 Published 2024-11-15 Fixed in 1.14.6, 2.2.11 +3 CWE-200

TI-2023-26170 CVE-2023-48307

Nextcloud Mail app vulnerable to Server-Side Request Forgery

MEDIUM 44

Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00866 Published 2023-11-21 Fixed in 2.2.8, 3.3.0 CWE-918

TI-2023-24461 CVE-2023-45660

Require strict cookies for image proxy requests in Nextcloud Mail

LOW 21

Nextcloud mail is an email app for the Nextcloud home server platform.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00759 Published 2023-10-16 Fixed in 2.2.8, 3.3.0 CWE-918

TI-2023-16361 CVE-2023-33184

Blind SSRF in the Nextcloud Mail app on avatar endpoint

LOW 25

Nextcloud Mail is a mail app in Nextcloud.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00529 Published 2023-05-27 Fixed in 1.15.3, 2.2.5 +1 CWE-918

TI-2023-10622 CVE-2023-25160

IDOR Vulnerability in Nextcloud Mail

LOW 24

Nextcloud Mail is an email app for the Nextcloud home server platform.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0046 Published 2023-02-13 Fixed in 1.11.8, 1.12.9 +2 CWE-639

TI-2023-09741 CVE-2023-23943

Blind SSRF via server URL input in the Nextcloud Mail app

MEDIUM 56

Nextcloud mail is an email app for the nextcloud home server platform.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00919 Published 2023-02-06 Fixed in 2.2.2, 1.15.0 CWE-918

TI-2023-09742 CVE-2023-23944

Nexcloud Mail app temporarily stores cleartext password in database

LOW 29

Nextcloud mail is an email app for the nextcloud home server platform.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00475 Published 2023-02-06 Fixed in 2.2.2 CWE-312

TI-2022-13163 CVE-2022-31119

Password disclosure in log file in Nextcloud Mail App

LOW 24

Nextcloud Mail is an email application for the nextcloud personal cloud product.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00833 Published 2022-08-04 Fixed in 1.12.1 CWE-532

TI-2022-13176 CVE-2022-31132

Unauthenticated SSRF in 3rd party module "cerdic/csstidy"

MEDIUM 49

Nextcloud Mail is an email application for the nextcloud personal cloud product.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00724 Published 2022-08-04 Fixed in 1.12.8, 1.13.6 CWE-918

TI-2021-16605 CVE-2021-39220

Bypass of image blocking in Nextcloud Mail

LOW 19

Nextcloud is an open-source, self-hosted productivity platform The Nextcloud Mail application prior to versions 1.10.4 and 1.11.0 does by default not render images in emails to not leak the read state or user IP.

CVSS 3.1LOW 3.5 Network Low privileges User interaction EPSS 0.0091 Published 2021-10-25 No fix listed CWE-20

TI-2021-12375 CVE-2021-32707

Bypass of image blocking in Nextcloud Mail

LOW 22

Nextcloud Mail is a mail app for Nextcloud.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01146 Published 2021-07-12 Fixed in 1.9.6 CWE-20

TI-2021-12320 CVE-2021-32652

Missing permission check on email metadata retrieval

MEDIUM 40

Nextcloud Mail is a mail app for the Nextcloud platform.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01107 Published 2021-06-01 Fixed in 1.4.3, 1.8.2 CWE-284

TI-2020-06574 CVE-2020-8156 · GHSA-fgvj-4m6x-j67f

A missing verification of the TLS host in Nextcloud Mail 1.1.3 allowed a man in the middle attack.

LOW 33

A missing verification of the TLS host in Nextcloud Mail 1.1.3 allowed a man in the middle attack.

CVSS 3.1HIGH 7.0 Network No auth No interaction EPSS 0.00956 Published 2020-05-12 No fix listed CWE-295

Vulnerabilities

Filters