BIT-nextcloud-2022-24886

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/nextcloud/BIT-nextcloud-2022-24886.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-nextcloud-2022-24886
Aliases
Published
2026-07-12T23:47:48.299Z
Modified
2026-07-13T06:26:14.692227268Z
Summary
Exposure of Sensitive Information to an Unauthorized Actor in com.nextcloud.client
Details

Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. In versions prior to 3.19.0, any application with notification permission can access contacts if Nextcloud has access to Contacts without applying for the Contacts permission itself. Version 3.19.0 contains a fix for this issue. There are currently no known workarounds.

Database specific 
{
    "severity": "Low",
    "cpes": [
        "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:android:*:*"
    ]
}
References

Affected packages

Bitnami / nextcloud

Package

Name
nextcloud
Purl
pkg:bitnami/nextcloud

Severity

  • 3.8 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.19.0

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/nextcloud/BIT-nextcloud-2022-24886.json"