What is the CVSS score of CVE-2026-45153?

CVE-2026-45153 has a CVSS 3.1 base score of 4.6 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-45153?

Yes, a patch is available for CVE-2026-45153. Update the affected software to the latest version immediately.

Nextcloud Files CVE-2026-45153

EUVD-2026-33672 MEDIUM

Improper Authentication (CWE-287)

2026-06-01 GitHub_M

Google Authentication Bypass Nextcloud

4.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.6 MEDIUM

AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Physical

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jun 01, 2026 - 18:01 EUVD

Source Code Evidence Fetched

Jun 01, 2026 - 17:22 vuln.today

Analysis Generated

Jun 01, 2026 - 17:22 vuln.today

CVE Published

Jun 01, 2026 - 16:37 nvd

MEDIUM 4.6

DescriptionGitHub Advisory

Nextcloud is an open source content collaboration platform. From version 33.0.0 to before version 33.1.0, after unlocking a locked Android phone the back-button could be used to bypass the Nextcloud Files app PIN. This issue has been patched in version 33.1.0.

AnalysisAI

PIN authentication bypass in the Nextcloud Files Android app (versions 33.0.0 through 33.0.x) allows a physically present attacker to circumvent the app's passcode lock screen by pressing the Android back button immediately after the host device is unlocked. The PassCodeActivity failed to intercept back-navigation events during PIN verification, granting direct file access without completing authentication. No public exploit identified at time of analysis and no CISA KEV listing; risk is tightly constrained by the physical access vector. Patched in version 33.1.0 via upstream PR #16896.

Technical ContextAI

The vulnerability resides in PassCodeActivity.kt within the Nextcloud Android client. Android's activity back-stack navigation was not overridden during the ACTION_CHECK phase (PIN verification), meaning the system's default back-press behavior would pop PassCodeActivity off the stack and render the underlying app accessible. The fix registers an OnBackPressedCallback via onBackPressedDispatcher that intercepts back-press events: when the activity is in ACTION_CHECK mode the callback returns immediately, blocking navigation; otherwise it disables itself and delegates to the default dispatcher. This is a CWE-287 (Improper Authentication) defect - the authentication gate existed but could be trivially circumvented through a standard OS interaction. CPE identifies the affected component as cpe:2.3:a:nextcloud:security-advisories:*:*:*:*:*:*:*:* scoped to the Android client build 33.0.0-33.0.x.

RemediationAI

Upgrade the Nextcloud Files Android app to version 33.1.0, which resolves the issue by registering an OnBackPressedCallback in PassCodeActivity to block back-navigation during PIN verification. The patch is documented in vendor advisory GHSA-2w7v-5299-3hw5 (https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2w7v-5299-3hw5) and delivered via PR #16896 (https://github.com/nextcloud/android/pull/16896). As a compensating control for organizations unable to update immediately, disabling the in-app PIN/passcode feature removes the vulnerable code path entirely; however, this eliminates the app-layer lock, so defenders must then rely solely on the device-level screen lock - acceptable only if device-level authentication is enforced by MDM policy with strong PIN or biometric requirements. No other workarounds have been confirmed in the available data.