Every CVE Search/ Get API key

CVE-2023-28999

Nextcloud: Lack of authenticity of metadata keys allows a malicious server to gain access to E2EE folders

6.9 MediumFix available

Nextcloud is an open-source productivity platform. In Nextcloud Desktop client 3.0.0 until 3.8.0, Nextcloud Android app 3.13.0 until 3.25.0, and Nextcloud iOS app 3.0.5 until 4.8.0, a malicious server administrator can gain full access to an end-to-end encrypted folder. They can decrypt files, recover the folder structure and add new files.​ This issue is fixed in Nextcloud Desktop 3.8.0, Nextcloud Android 3.25.0, and Nextcloud iOS 4.8.0. No known workarounds are available.

Attack profile

How easy it is to exploit

Attack vector
Physical
Complexity
Low
Privileges needed
High
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
Low

Exploit likelihood

0.68%Up 0.6 points since Apr 5, 2023
90%50%10%1%

What each source reports

CVE List Score used 6.9

Nextcloud: Lack of authenticity of metadata keys allows a malicious server to gain access to E2EE folders

Nextcloud is an open-source productivity platform. In Nextcloud Desktop client 3.0.0 until 3.8.0, Nextcloud Android app 3.13.0 until 3.25.0, and Nextcloud iOS app 3.0.5 until 4.8.0, a malicious server administrator can gain full access to an end-to-end encrypted folder. They can decrypt files, recover the folder structure and add new files.​ This issue is fixed in Nextcloud Desktop 3.8.0, Nextcloud Android 3.25.0, and Nextcloud iOS 4.8.0. No known workarounds are available.

Record
CVE-2023-28999
CVSS 3.1
6.9 MediumCVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L
Weakness
CWE-325
Updated
2026-11-02
EUVDEUVD-2023-32617 6.9

Nextcloud is an open-source productivity platform. In Nextcloud Desktop client 3.0.0 until 3.8.0, Nextcloud Android app 3.13.0 until 3.25.0, and Nextcloud iOS app 3.0.5 until 4.8.0, a malicious server administrator can gain full access to an end-to-end encrypted folder. They can decrypt files, recover the folder structure and add new files.​ This issue is fixed in Nextcloud Desktop 3.8.0, Nextcloud Android 3.25.0, and Nextcloud iOS 4.8.0. No known workarounds are available.

Record
EUVD-2023-32617
CVSS 3.1
6.9 MediumCVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L
Updated
2026-11-03
NVD 6.9

Nextcloud is an open-source productivity platform. In Nextcloud Desktop client 3.0.0 until 3.8.0, Nextcloud Android app 3.13.0 until 3.25.0, and Nextcloud iOS app 3.0.5 until 4.8.0, a malicious server administrator can gain full access to an end-to-end encrypted folder. They can decrypt files, recover the folder structure and add new files.​ This issue is fixed in Nextcloud Desktop 3.8.0, Nextcloud Android 3.25.0, and Nextcloud iOS 4.8.0. No known workarounds are available.

Record
CVE-2023-28999
CVSS 3.1
6.9 MediumCVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L
Weakness
CWE-325, CWE-311
Updated
2026-11-02
OSVALPINE-CVE-2023-28999 6.4

Nextcloud is an open-source productivity platform. In Nextcloud Desktop client 3.0.0 until 3.8.0, Nextcloud Android app 3.13.0 until 3.25.0, and Nextcloud iOS app 3.0.5 until 4.8.0, a malicious server administrator can gain full access to an end-to-end encrypted folder. They can decrypt files, recover the folder structure and add new files.​ This issue is fixed in Nextcloud Desktop 3.8.0, Nextcloud Android 3.25.0, and Nextcloud iOS 4.8.0. No known workarounds are available.

Record
ALPINE-CVE-2023-28999
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L
Updated
2026-11-03
OSV 6.9

Nextcloud: Lack of authenticity of metadata keys allows a malicious server to gain access to E2EE folders

Nextcloud is an open-source productivity platform. In Nextcloud Desktop client 3.0.0 until 3.8.0, Nextcloud Android app 3.13.0 until 3.25.0, and Nextcloud iOS app 3.0.5 until 4.8.0, a malicious server administrator can gain full access to an end-to-end encrypted folder. They can decrypt files, recover the folder structure and add new files.​ This issue is fixed in Nextcloud Desktop 3.8.0, Nextcloud Android 3.25.0, and Nextcloud iOS 4.8.0. No known workarounds are available.

Record
CVE-2023-28999
CVSS 3.1
6.9 MediumCVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L
Weakness
CWE-325
Updated
2026-11-02
OSVDEBIAN-CVE-2023-28999 6.4

Nextcloud is an open-source productivity platform. In Nextcloud Desktop client 3.0.0 until 3.8.0, Nextcloud Android app 3.13.0 until 3.25.0, and Nextcloud iOS app 3.0.5 until 4.8.0, a malicious server administrator can gain full access to an end-to-end encrypted folder. They can decrypt files, recover the folder structure and add new files.​ This issue is fixed in Nextcloud Desktop 3.8.0, Nextcloud Android 3.25.0, and Nextcloud iOS 4.8.0. No known workarounds are available.

Record
DEBIAN-CVE-2023-28999
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2023-28999 6.9

Nextcloud is an open-source productivity platform. In Nextcloud Desktop client 3.0.0 until 3.8.0, Nextcloud Android app 3.13.0 until 3.25.0, and Nextcloud iOS app 3.0.5 until 4.8.0, a malicious server administrator can gain full access to an end-to-end encrypted folder. They can decrypt files, recover the folder structure and add new files.​ This issue is fixed in Nextcloud Desktop 3.8.0, Nextcloud Android 3.25.0, and Nextcloud iOS 4.8.0. No known workarounds are available.

Record
UBUNTU-CVE-2023-28999
CVSS 3.1
6.9 MediumCVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L
CVSS 3.1
6.4 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L
Updated
2026-11-02
OSVBIT-nextcloud-2023-28999 No score

Nextcloud: Lack of authenticity of metadata keys allows a malicious server to gain access to E2EE folders

Nextcloud is an open-source productivity platform. In Nextcloud Desktop client 3.0.0 until 3.8.0, Nextcloud Android app 3.13.0 until 3.25.0, and Nextcloud iOS app 3.0.5 until 4.8.0, a malicious server administrator can gain full access to an end-to-end encrypted folder. They can decrypt files, recover the folder structure and add new files.​ This issue is fixed in Nextcloud Desktop 3.8.0, Nextcloud Android 3.25.0, and Nextcloud iOS 4.8.0. No known workarounds are available.

Record
BIT-nextcloud-2023-28999
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nextcloud-client
Alpine:v3.18
 before 3.8.1-r0
3.8.1-r0
nextcloud-client
Alpine:v3.19
 before 3.8.1-r0
3.8.1-r0
nextcloud-client
Alpine:v3.20
 before 3.8.1-r0
3.8.1-r0
nextcloud-client
Alpine:v3.21
 before 3.8.1-r0
3.8.1-r0
nextcloud-client
Alpine:v3.22
 before 3.8.1-r0
3.8.1-r0
nextcloud-client
Alpine:v3.23
 before 3.8.1-r0
3.8.1-r0
nextcloud-client
Alpine:v3.24
 before 3.8.1-r0
3.8.1-r0
nextcloud
Bitnami
 3.0.5 up to 4.8.0
4.8.0
nextcloud-desktop
Debian:12
 All versions, plus listed versions
3.10.0-13.11.0-13.11.0-1.13.11.0-1.1~exp13.13.2-1
Show 29 moreShow less
3.13.2-23.14.1-13.15.0-13.15.2-13.15.2-23.15.3-13.16.0-13.16.2-13.16.4-13.16.6-13.16.6-23.16.6-33.16.7-13.16.7-1~deb13u13.7.3-13.7.3-1+deb12u13.7.3-1+deb12u23.9.0-133.0.0-133.0.0-233.0.2-133.0.2-233.0.2-333.0.7-135.0.0-14.0.1-14.0.1-24.0.1-34.0.6-1
 None known
nextcloud-desktop
Debian:13
 before 3.9.0-1
3.9.0-1
Show 7 moreShow less
Affected packages
PackageAffectedFixed
nextcloud-desktop
Debian:14
 before 3.9.0-1
3.9.0-1
nextcloud-desktop
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.5.3-12.6.0-12.6.1-12.6.1-22.6.2-12.6.2-1build1
 None known
nextcloud-desktop
Ubuntu:22.04:LTS
 All versions, plus listed versions
3.2.3-0ubuntu13.3.5-13.3.5-1ubuntu13.4.2-13.4.2-1ubuntu1
 None known
nextcloud-desktop
Ubuntu:24.04:LTS
 All versions, plus listed versions
3.9.0-13.10.0-13.11.0-13.11.0-1.1build33.11.0-1.1build4
 None known
nextcloud-desktop
Ubuntu:25.10
 All versions, plus listed versions
3.16.0-13.16.2-13.16.4-13.16.6-13.16.6-3
 None known
nextcloud-desktop
Ubuntu:26.10
 All versions, plus listed versions
4.0.6-133.0.2-133.0.7-1ubuntu1
 None known
nextcloud-desktop
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.16.6-33.16.7-14.0.1-24.0.1-2build14.0.6-1
 None known

History

History
RecordedChangedSources
affected, aliases, referencesOSV
aliases, products, publishedEUVD
first indexedCVE List, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-28999 is a medium vulnerability (CVSS 6.9) in Nextcloud Desktop, published April 4, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.68%, the 52nd percentile. Fixed in nextcloud-client 3.8.1-r0.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open