Nextcloud Deck vulnerabilities

• nextcloud deck The Deck config API allows authenticated users to set board-scoped configuration keys for... CVE-2026-77170 4.3 MediumSeptember 18, 2026
• nextcloud deck, kiteworks security-advisories +1 more Nextcloud Deck app allowed user with "Can share" permission to modify permissions of other non-owners CVE-2025-66557 5.4 MediumDecember 5, 2025
• nextcloud deck, kiteworks security-advisories +1 more Nextcloud Deck app allows to spoof file extensions by using RTLO characters CVE-2025-66548 3.3 LowDecember 5, 2025
• nextcloud deck, kiteworks security-advisories +1 more Nextcloud Deck can access comments and attachments of deleted cards CVE-2024-37883 4.3 MediumJune 14, 2024
• nextcloud deck, kiteworks security-advisories +1 more Cross-site Scripting when sending HTML as a comment in the Nextcloud Deck app CVE-2024-22213 0.0 NoneJanuary 18, 2024
• nextcloud deck, kiteworks security-advisories +1 more Nextcloud Deck vulnerable to authorization bypass CVE-2023-22471 3.5 LowJanuary 14, 2023
• nextcloud deck, kiteworks security-advisories +1 more Nextcloud Deck vulnerable to uncontrolled resource consumption CVE-2023-22470 3.5 LowJanuary 14, 2023
• nextcloud deck, kiteworks security-advisories +1 more Nextcloud Deck card vulnerable to data leak to unauthorized users via reference preview cache CVE-2023-22469 5.8 MediumJanuary 10, 2023
• nextcloud deck, kiteworks security-advisories +1 more Error in deleting deck cards attachment reveals the full application path in Nextcloud Deck CVE-2022-24906 3.5 LowMay 20, 2022
• nextcloud deck, kiteworks security-advisories +1 more Possibility for anyone to add a stack with existing tasks on anyone's board in Nextcloud Deck CVE-2022-29159 5.0 MediumMay 20, 2022
• nextcloud deck, kiteworks security-advisories +1 more Missing permission check on Deck API CVE-2021-39225 8.1 HighOctober 25, 2021
• nextcloud deck, kiteworks security-advisories +1 more Circle can be accessed by non-Circle members in Nextcloud Deck CVE-2021-37631 6.5 MediumSeptember 7, 2021
• nextcloud deck Nextcloud Deck before 1.2.7, 1.4.1 suffers from an information disclosure vulnerability when searches for sharees utilize the lookup server by default instead of only the local Nextcloud server unless… CVE-2021-22913 6.5 MediumJune 11, 2021
• nextcloud deck Nextcloud Deck before 1.0.2 suffers from an insecure direct object reference (IDOR) vulnerability... CVE-2020-8297 4.3 MediumFebruary 23, 2021
• nextcloud deck Improper access control in Nextcloud Deck 0.8.0 allowed an attacker to reshare boards shared with... CVE-2020-8182 8.0 HighOctober 5, 2020
• nextcloud deck Missing access control in Nextcloud Deck 1.0.4 caused an insecure direct object reference... CVE-2020-8235 4.3 MediumOctober 5, 2020
• nextcloud deck Improper access control in Nextcloud Deck 1.0.0 allowed an attacker to inject tasks into other... CVE-2020-8179 4.1 MediumJuly 2, 2020
• hackerone nextcloud server, nextcloud deck, server +1 more +3 more Improper neutralization of file names, conversation names and board names in Nextcloud Server 16... CVE-2019-15619 4.8 MediumFebruary 4, 2020