~/f4n6 $ grep -r "Nextcloud server and apps face multiple security flaws allowing data manipulation and DoS" ./investigations/ --include="*.md"

Nextcloud server and apps face multiple security flaws allowing data manipulation and DoS

Jeff Davies 27 Oct 2026 5 min read

1. Executive summary

Nextcloud has published fixes for multiple vulnerabilities across its server product and several apps (Collectives, files_lock, Team Folders), with the CERT-FR advisory of 9 October 2026 listing affected ranges down to specific patch levels and citing five GitHub Security Advisories and five CVE identifiers. The flaws allow a remote authenticated attacker to bypass security policy, disclose or manipulate data, escalate privileges and trigger denial of service. No CVSS score, severity rating, EPSS estimate or CISA KEV entry is available for any of the CVEs in the sources provided, so this advisory does not assign one. EMEA financial services firms running self-hosted Nextcloud for document collaboration, file sharing or team workspaces should treat the server and Team Folders fixes as the priority, because those components sit closest to stored client data.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

3. Technical analysis & attack chain

The sources describe the vulnerability set at the level of affected products and impact categories. They do not publish the individual flaw mechanisms, the request paths, the vulnerable code, or proof-of-concept detail. What follows is limited to what CERT-FR and BSI state.

  1. An attacker authenticates to a Nextcloud instance. BSI describes the actor as a remote, authenticated attacker (corpus-1).
  2. The attacker targets one or more of the affected components: Nextcloud Server, Collectives, files_lock, or Team Folders, at a version below the fixed release listed by CERT-FR (corpus-2).
  3. Successful exploitation yields one or more of: bypass of the security policy, elevation of privileges, disclosure of confidential data, or a remote denial of service (corpus-2).

Affected versions, verbatim from CERT-FR (corpus-2):

  • Collectives before 4.4.1
  • files_lock 33.0.x before 33.0.6
  • Server 32.0.x before 32.0.12
  • Server 33.0.x before 33.0.6
  • Server 34.0.x before 34.0.1
  • Team Folders before 13.1.8, and 14.x before 14.0.12, 15.x before 15.3.13, 16.x before 16.0.16, 17.x before 17.0.16, 18.x before 18.1.14, 19.x before 19.1.19, 20.x before 20.1.15, 21.x before 21.0.8, 22.x before 22.0.1

The CVE identifiers named by CERT-FR are CVE-2026-68493, CVE-2026-77165, CVE-2026-77166, CVE-2026-77169 and CVE-2026-82985. CERT-FR does not map individual CVEs to individual components or impact categories, and the sources do not state which CVE corresponds to privilege escalation versus denial of service versus data disclosure. An analyst should read the five linked GitHub Security Advisories (GHSA-22w9-gpgv-pcgc, GHSA-4vpp-fp9q-9g23, GHSA-5gv7-hw69-w6px, GHSA-9mjh-89xm-hcqw, GHSA-f99w-3pm7-v4cv) to obtain per-CVE mechanism, CVSS and affected-component detail before scoping exposure.

The primary BSI item (WID-SEC-2026-4185) additionally names the Tables, Whiteboard, Files Confidential and Richdocuments apps in its title, but the fetched content does not give versions or CVEs for those apps. CERT-FR does not list them. Treat their inclusion as unconfirmed pending the vendor advisories.

The BSI advisory WID-SEC-2026-3840 (corpus-1) is a separate, earlier Nextcloud advisory covering server and app flaws with the same impact categories. It is not the same advisory as the primary item and its affected versions are not given in the fetched text. Do not conflate the two when building an inventory.

No exploitation in the wild, no attributed threat actor and no observed attack campaign are reported in any source. The attack chain above is the exploitation path the vulnerability classes permit, not a record of activity.

4. Mitigation & containment

P1 (within 24 hours)

  • Inventory every Nextcloud instance and app in the estate and record the exact server version and each app version. Compare against the CERT-FR ranges in §3. Instances on Server 34.0.x before 34.0.1, 33.0.x before 33.0.6 or 32.0.x before 32.0.12 are exposed.
  • Upgrade Nextcloud Server to 34.0.1, 33.0.6 or 32.0.12 respectively, following the vendor upgrade path. Upgrade Team Folders to the fixed release for the deployed major line (13.1.8, 14.0.12, 15.3.13, 16.0.16, 17.0.16, 18.1.14, 19.1.19, 20.1.15, 21.0.8 or 22.0.1).
  • Upgrade Collectives to 4.4.1 and files_lock to 33.0.6.
  • Where an instance cannot be patched inside 24 hours, restrict access to authenticated internal users only, remove anonymous share links, and place the instance behind the WAF or reverse proxy with request-rate limits to blunt the denial-of-service path.

P2 (within 72 hours)

  • Read the five GitHub Security Advisories cited by CERT-FR and map each CVE to its component and impact. Use that mapping to confirm which of the deployed apps carry the privilege-escalation and data-disclosure flaws, and prioritise accordingly.
  • Confirm the status of the Tables, Whiteboard, Files Confidential and Richdocuments apps named in the BSI title. If deployed, check the vendor advisory for fixed versions; the sources provided do not give them.
  • Review Nextcloud audit logs for the period since the earliest affected version was deployed, looking for privilege changes, unexpected admin-account activity, mass file access or share-policy changes by non-admin accounts.

P3 (within 7 days)

  • Add Nextcloud server and app versions to the continuous asset inventory so future advisories can be matched without a manual sweep.
  • Where Nextcloud is hosted or managed by a third party, confirm in writing that the provider has applied the fixed releases, and record the confirmation against the contract.

5. Indicators of compromise

No indicators of compromise available in the source material.

The sources describe impact categories (policy bypass, privilege escalation, data disclosure, denial of service) but give no file hashes, network indicators, file paths, registry keys or log artefacts. CERT-FR and BSI publish no atomic indicators for this advisory set.

6. Detection

Insufficient indicators to author detection rules.

The sources provide no distinctive strings, command-line flags, file names, paths, registry keys or behavioural log artefacts specific to these vulnerabilities. Authoring a YARA or Sigma rule from the CVE identifiers or product names would detect reporting about the flaws, not exploitation of them. Detection should instead rely on the version inventory and audit-log review described in §4 until the vendor advisories supply mechanism detail.

7. Sources

  • BSI Germany, [NEU] [mittel] Nextcloud (Server, Tables, Whiteboard, Files Confidential, Collectives, Richdocuments): Mehrere Schwachstellen (WID-SEC-2026-4185), 2026-10-27. https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-4185
  • BSI Germany, [NEU] [mittel] Nextcloud: Mehrere Schwachstellen (WID-SEC-2026-3840). https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3840
  • ANSSI CERT-FR, Multiples vulnérabilités dans les produits Nextcloud (CERTFR-2026-AVI-1283), 2026-10-09. https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1283/
  • ANSSI CERT-FR, Multiples vulnérabilités dans les produits Nextcloud (CERTFR-2026-AVI-0973), 2026-08-06. https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0973/
  • Nextcloud security advisories cited by CERT-FR, 2026-10-08: GHSA-22w9-gpgv-pcgc, GHSA-4vpp-fp9q-9g23, GHSA-5gv7-hw69-w6px, GHSA-9mjh-89xm-hcqw, GHSA-f99w-3pm7-v4cv. https://github.com/nextcloud/security-advisories/security/advisories/GHSA-22w9-gpgv-pcgc (and the corresponding paths for the other four identifiers)

8. Adverse Trace position

Adverse Trace assesses this as a moderate-priority patching item for EMEA financial services clients running self-hosted Nextcloud. No CVSS score, EPSS estimate or CISA KEV entry is available in the sources, no exploitation in the wild is reported, and no threat actor is attributed, so we do not raise it above routine patch-cycle handling. The exposure that matters is data: Nextcloud instances in a financial firm typically hold client documents and internal collaboration content, and the privilege-escalation and data-disclosure flaws in the server and Team Folders components put that content at risk from any authenticated user. The affected-version list is single-sourced to CERT-FR for the app ranges and the CVE-to-component mapping is absent from all sources, so clients should verify against the five Nextcloud GitHub advisories before closing the item. We will monitor the vendor advisories for per-CVE severity and any exploitation reporting, and will reissue this advisory if a CVSS score, KEV listing or in-the-wild activity is confirmed.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.

Post this to LinkedIn
Formatting is converted automatically — headings, bullets, a link back & hashtags. Paste straight in.
J
Jeff Davies