CVE-2023-26482

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-26482
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-26482.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-26482
Aliases
  • GHSA-h3c9-cmh8-7qpj
Published
2023-03-30T18:27:17.333Z
Modified
2026-08-12T03:51:10.313688664Z
Severity
  • 9.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Scope of workflow operations is not validated in nextcloud server
Details

Nextcloud server is an open source home cloud implementation. In affected versions a missing scope validation allowed users to create workflows which are designed to be only available for administrators. Some workflows are designed to be RCE by invoking defined scripts, in order to generate PDFs, invoking webhooks or running scripts on the server. Due to this combination depending on the available apps the issue can result in a RCE at the end. It is recommended that the Nextcloud Server is upgraded to 24.0.10 or 25.0.4. Users unable to upgrade should disable app workflow_scripts and workflow_pdf_converter as a mitigation.

Database specific 
{
    "cwe_ids": [
        "CWE-78"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26482.json"
}
References

Affected packages

Git / github.com/nextcloud/server

Affected ranges

Type
GIT
Repo
https://github.com/nextcloud/server
Events
Introduced
5f37aacb3194d51503aaa3529ae8f676b32a25d7
Fixed
9fcbbc523ea041301fc5a8acc50d6a8ec5b328e5
Introduced
20ea9a25353129b56d46951fe7d23939665ab2b2
Fixed
0c86714144f50a66e845e9ef80d4cd7e6918a4f5
Fixed
5a06b50b10cc9278bbe68bbf897a0c4aeb0c4e60
Database specific
Show details 
{
    "cpe": [
        "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*",
        "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "24.0.0"
        },
        {
            "fixed": "24.0.10"
        },
        {
            "introduced": "25.0.0"
        },
        {
            "fixed": "25.0.4"
        }
    ]
}

Affected versions

v24.*
v24.0.0
v24.0.1
v24.0.10rc1
v24.0.1rc1
v24.0.2
v24.0.2rc1
v24.0.3
v24.0.3rc1
v24.0.3rc2
v24.0.4
v24.0.4rc1
v24.0.5
v24.0.5rc1
v24.0.6
v24.0.6rc1
v24.0.7
v24.0.7rc1
v24.0.8
v24.0.8rc1
v24.0.8rc2
v24.0.9
v24.0.9rc1
v24.0.9rc2
v25.*
v25.0.0
v25.0.1
v25.0.1rc1
v25.0.2
v25.0.2rc1
v25.0.2rc2
v25.0.2rc3
v25.0.3
v25.0.3rc1
v25.0.3rc2
v25.0.4rc1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-26482.json"