- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
Verify to analyze this security profile
As of 10/23/2026, Nextcloud recorded 0 security vulnerabilities in the last 90 days, of which 0 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of Nextcloud and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2025-59788CVE-2025-59788CVE-2023-49790App PIN code can be bypassed in Nextcloud Files iOSCVE-2023-28999Nextcloud: Lack of authenticity of metadata keys allows a malicious server to gain access to E2EE foldersCVE-2023-28646App lockout in nextcloud Android app can be bypassed via thirdparty appsCVE-2023-28647App pin of the iOS app can be bypassed in Nextcloud iOS| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2025-59788CVE-2025-59788 | Exploitation statusActively exploited | FixYes | Published12/04/2025 | SeverityMedium |
CVE-2023-49790App PIN code can be bypassed in Nextcloud Files iOS | Exploitation statusNot confirmed | FixNo | Published12/22/2023 | SeverityMedium |
CVE-2023-28999Nextcloud: Lack of authenticity of metadata keys allows a malicious server to gain access to E2EE folders | Exploitation statusNot exploited | FixYes | Published04/04/2023 | SeverityMedium |
CVE-2023-28646App lockout in nextcloud Android app can be bypassed via thirdparty apps | Exploitation statusNot exploited | FixNo | Published03/30/2023 | SeverityMedium |
CVE-2023-28647App pin of the iOS app can be bypassed in Nextcloud iOS | Exploitation statusNot exploited | FixNo | Published03/30/2023 | SeverityMedium |
CVE-2022-39210Access to internal files of the Nextcloud Android app | Exploitation statusNot exploited | FixNo | Published09/16/2022 | SeverityLow |
CVE-2022-29160Sensitive files/data exist after deletion of user account in Nextcloud Android | Exploitation statusActively exploited | FixNo | Published05/20/2022 | SeverityLow |
CVE-2022-24886Exposure of Sensitive Information to an Unauthorized Actor in com.nextcloud.client | Exploitation statusNot exploited | FixNo | Published04/27/2022 | SeverityLow |
CVE-2022-24885Improper Authentication in Nextcloud Android Files | Exploitation statusActively exploited | FixNo | Published04/27/2022 | SeverityLow |
CVE-2021-41166Permission bypass in Nextcloud Android App | Exploitation statusNot exploited | FixNo | Published01/26/2022 | SeverityMedium |
29 Results | Page 1 of 3