CVE-2023-22471— Nextcloud Deck vulnerable to authorization bypass
Quick assessment
Affected
nextcloud security-advisories
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Nextcloud是德国Nextcloud公司的一套开源的自托管文件同步和共享的通信应用平台。 Nextcloud Deck 1.6.5之前版本、1.7.3之前的1.7.x版本、1.8.2之前的1.8.x版本存在安全漏洞，该漏洞源于。
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud Storage
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-22471
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Nextcloud Deck vulnerable to authorization bypass
Source: CVE Program / CVE List V5
Vulnerability Description
Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Broken access control allows a user to delete attachments of other users. There are currently no known workarounds. It is recommended that the Nextcloud Deck app is upgraded to 1.6.5 or 1.7.3 or 1.8.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Vulnerability Title
Nextcloud 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Nextcloud是德国Nextcloud公司的一套开源的自托管文件同步和共享的通信应用平台。 Nextcloud Deck 1.6.5之前版本、1.7.3之前的1.7.x版本、1.8.2之前的1.8.x版本存在安全漏洞，该漏洞源于。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| nextcloud | security-advisories | >= 1.60, < 1.6.5 | - |
|
II. Public POCs for CVE-2023-22471
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-22471
请登录查看更多情报信息。
Patches & Fixes for CVE-2023-22471 (1)
-
https://github.com/nextcloud/deck/pull/4173 x_refsource_MISC
Vendor Advisories for CVE-2023-22471 (1)
IV. Related Vulnerabilities
Same product: security-advisories
-
CVE-2026-24754
Kiteworks Secure Data Forms Vulnerable to Cross-site Scripti -
CVE-2026-45810
Nextcloud: Propfind requests for file comments allowed to lo -
CVE-2026-45722
Nextcloud: Tables app allows limited SQLi in ORDER BY with m -
CVE-2026-45691
Nextcloud: Bypass of second factor authentication on DAV end -
CVE-2026-45690
Nextcloud: Two-Factor Authentication Bypass via Pending Sess
Same vendor: nextcloud
-
CVE-2026-45810
Nextcloud: Propfind requests for file comments allowed to lo -
CVE-2026-45722
Nextcloud: Tables app allows limited SQLi in ORDER BY with m -
CVE-2026-45691
Nextcloud: Bypass of second factor authentication on DAV end -
CVE-2026-45690
Nextcloud: Two-Factor Authentication Bypass via Pending Sess -
CVE-2026-45545
Nextcloud: SQL Injection in Column Type Parameter Allows Arb
Same weakness: CWE-639
-
CVE-2026-69129
KubePi: Insufficient per-cluster authorization checks in clu -
CVE-2026-65642
Plesk 18.0.79.7及18.0.80.3前存在IDOR漏洞 -
CVE-2026-77368
SeaweedFS: Authenticated Cross-Prefix IDOR in Filer TUS Hand -
CVE-2026-55228
Weblate:: WebIDOR in GroupViewSet allows authenticated proje -
CVE-2026-74771
Dell PowerProtect One 20.1.0及以下用户可控密钥认证绕过
V. Comments for CVE-2023-22471
No comments yet