EUVD-2026-65596
GHSA-8vh3-g2qg-2h2c
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Unauthenticated network request with no user interaction (AV:N/AC:L/PR:N/UI:N); attacker can delete/corrupt any user's embeddings (I:H) and destroy the index (A:H) but cannot read data (C:N).
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
4DescriptionCVE.org
Nextcloud MCP Server is a production-ready MCP server that connects AI assistants to a Nextcloud instance. Prior to 0.117.2, the POST /webhooks/nextcloud endpoint in nextcloud_mcp_server/vector/webhook_receiver.py has no authentication by default because WEBHOOK_SECRET defaults to None and startup validation does not require it. When WEBHOOK_SECRET is unset, handle_nextcloud_webhook() accepts unauthenticated requests. The payload["user"]["uid"] field parsed in nextcloud_mcp_server/vector/webhook_parser.py is attacker-controlled and is used without an authenticated-session cross-check for Qdrant operations, allowing a network attacker to delete or trigger re-indexing of vector embeddings for any user and to destroy the semantic search index by sending forged deletion events. This issue is fixed in version 0.117.2.
AnalysisAI
Unauthenticated vector-store tampering in Nextcloud MCP Server before 0.117.2 lets any network attacker who can reach the /webhooks/nextcloud endpoint delete or force re-indexing of Qdrant semantic-search embeddings for arbitrary users. Because WEBHOOK_SECRET defaults to None and startup never enforces it, the webhook receiver processes forged POSTs and trusts the attacker-supplied user.uid, so looping over document IDs can wipe the entire search index for all users. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires that the webhook receiver be active and reachable AND that WEBHOOK_SECRET be unset - which is the default in versions <= 0.117.1, so no special configuration is needed beyond the endpoint being network-reachable to the attacker (advisory cites port 8000). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue for anyone who has enabled webhook-based vector sync, but its blast radius is bounded to search-index integrity/availability rather than data confidentiality. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to nextcloud-mcp-server 0.117.2 (commit 4fc2b10945108cf1008ec9698291de6706ffcb73), which makes WEBHOOK_SECRET mandatory - when it is unset the /webhooks/nextcloud route is no longer mounted (404) and any request that reaches the handler is refused (503), and when set every delivery must carry a valid Authorization: Bearer <secret> header (mismatches rejected with 401). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit all deployments to identify Nextcloud MCP Server versions prior to 0.117.2 and assess exposure risk, noting that publicly available exploit code exists. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Nextcloud server is an open source home cloud implementation. Rated high severity (CVSS 8.8), this vulnerability is remo
A too lax check in Nextcloud Talk 6.0.4, 7.0.2 and 8.0.7 allowed a code injection when a not correctly sanitized talk co
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Rated critical severity (CVSS 9.8),
Nextcloud Server before 9.0.54 and 10.0.1 & ownCloud Server before 9.1.2, 9.0.6, and 8.2.9 suffer from SMB User Authenti
NextCloud Cookbook is a recipe library app. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,
Nextcloud server is an open source home cloud implementation. Rated high severity (CVSS 8.8), this vulnerability is remo
Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowi
lib/Controller/ExtractionController.php in the Extract add-on before 1.2.0 for Nextcloud allows Remote Code Execution vi
Insufficient protection of the server-side encryption keys in Nextcloud Server 19.0.1 allowed an attacker to replace the
A bug in Nextcloud Server 14.0.4 could expose more data in reshared link shares than intended by the sharer. Rated high
Improper access control in Nextcloud Deck 0.8.0 allowed an attacker to reshare boards shared with them with more permiss
A code injection in Nextcloud Desktop Client 2.6.4 allowed to load arbitrary code when placing a malicious OpenSSL confi
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today