EUVD-2026-111131Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid app password token
-
ExploitCall sensitive endpoint via API
-
ExecutionBypass password-confirmation gate
-
ImpactPerform privileged account actions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already possess a valid Nextcloud app password (an application-specific token), so the actor must be authenticated at the app-password level (PR:L) - this is the concrete prerequisite named by the flaw. The affected feature is the password-confirmation (re-authentication) gate guarding sensitive endpoints, which app passwords were improperly allowed to satisfy. Limiting factors: only Nextcloud Server versions 32.0.0 through 34.0.0 are listed as affected; impact is confined to integrity-affecting sensitive actions (C:N/A:N), and the attacker must first obtain an app-password token rather than exploiting an unauthenticated default install. |
| Impact | This is a moderate-severity issue (CVSS 5.3, CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N) that is a real but not emergency-level priority. The vuln.today Decision label is 'this_month', consistent with a medium-risk authenticated flaw rather than an urgent widespread threat. The CVSS vector shows network reach (AV:N) but requires existing low privileges (PR:L) - specifically possession of a Nextcloud app password - and the impact is limited to integrity (I:H) with no confidentiality or availability effect (C:N/A:N), reflecting a privilege-management/authorization-bypass bug (CWE-269) rather than full compromise. No EPSS score is provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing, so this is not confirmed as actively exploited. The report originates from HackerOne (#3566607) with a VulDB advisory, indicating a vetted but not necessarily weaponized finding. Net: a legitimate authorization-bypass worth patching on a normal cycle, not a high-CVSS-but-ignorable issue nor a drop-everything emergency; the missing EPSS and absence of confirmed active exploitation should be noted when prioritizing. |
| Exploit ScenarioDerived | An attacker who holds a valid Nextcloud app password (for example a leaked or phished application token, which normally has limited rights) uses it to reach sensitive endpoints that are supposed to demand interactive main-password re-confirmation. Because app passwords were allowed to satisfy that confirmation gate, the attacker performs privileged account actions without ever knowing the victim's primary password. A public PoC reference exists via the HackerOne report but it is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Nextcloud Server 32.0.0 through 34.0.0 accepts an application-specific app password as sufficient proof for the password-confirmation (re-authentication) gate that protects sensitive endpoints, so anyone holding a valid app-password token can perform integrity-affecting privileged actions that should have required the real account password. The concrete prerequisite is possession of such a token (the flaw is rated PR:L), which typically means a leaked, over-scoped or stale app password rather than an unauthenticated attacker. Severity is moderate (CVSS 5.3 vendor score, 5.3 equivalent under our assessment, which raises AC:H to AC:L because no unusual conditions beyond holding the token are needed); there is no CISA KEV entry and no public exploit code identified at time of analysis, only the original HackerOne report, so this is a this-month priority rather than an emergency.
RemediationAI
No vendor-released patch with an exact fixed version appears in the supplied data, and no vendor-documented workaround is listed, so the first step is to confirm the fixed release on Nextcloud's security advisories and upgrade Nextcloud Server out of the affected 32.0.0-34.0.0 range as soon as a patched build is confirmed for your branch. Because the exploitation prerequisite is a valid app password, the exposure-reducing control that follows directly from the flaw is to inventory and revoke unnecessary, stale or over-scoped app passwords (Settings → Security → Devices & sessions) so that fewer tokens exist that could satisfy the confirmation gate; the trade-off is that revoking tokens breaks connected desktop and mobile clients until they are re-authenticated. Until a patched release is applied, treat app-password compromise as equivalent to full account-password compromise for sensitive-setting changes, and review audit logs for security-relevant configuration changes made from app-password sessions. Track the HackerOne report at https://hackerone.com/reports/3566607 and the VulDB entry at https://vuldb.com/vuln/427453 for the vendor fix version; this is a this-month priority, not an emergency, given no KEV entry and no identified public exploit code.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The weakness class is CWE-269 (Improper Privilege Management). Nextcloud, like many web applications, uses a password-confirmation step - a fresh re-entry of the account password - as a soft re-authentication barrier in front of security-sensitive endpoints such as security settings and credential management. App passwords are long-lived, application-specific tokens intended for clients (desktop/mobile sync, DAV, CalDAV/CardDAV) that cannot perform interactive confirmation. CVE-2026-77172 is the case where that distinction collapsed: the confirmation check accepted an app password, effectively granting a token the same authority as the account password for the guarded operations. The network vector (AV:N) reflects that the abuse happens over ordinary HTTP(S) API/web routes; PR:L reflects the requirement for a valid app-password token; integrity-only impact (C:N/I:H/A:N) reflects that the outcome is unauthorized modification of account or server configuration rather than data disclosure or denial of service. Note the scoring divergence: the vendor vector is CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N while our assessment uses CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - the attack complexity is low once the token exists; no race, memory-safety or attacker-uncontrolled precondition is described in the available sources, and the exact endpoint set and triggering request flow are not enumerated in the supplied data. Affected per EUVD: Server 32.0.0 up to and including 34.0.0, matching CPE cpe:2.3:a:nextcloud:server with an unbounded version wildcard.
Know when Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Requires an existing app-password token so PR:L and not PR:N; bypass is deterministic once the token is held (AC:L); impact is integrity-only, so C:N and A:N.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
DescriptionCVE.org
App passwords were allowed to bypass password confirmation on sensitive endpoints.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Traccar Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of Generation of Code ('Code Injectio
Account takeover in self-hosted Bitwarden Server before 2026.6.0 lets a low-privileged organization member steal any oth
Full user impersonation in the Laci Synchroni sync server (backend prior to 1.2.3) lets an attacker take over any accoun
Provider service users in Bitwarden Server Cloud can hijack arbitrary organizations via unauthorized API endpoint access
NoMachine Server is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack compl
NoMachine Server is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack comple
Authentication bypass in Bitwarden Server versions prior to 2026.4.1 allows authenticated users with SCIM management pri
JetAudio jetCast Server 2.0 contains a stack-based buffer overflow vulnerability in the Log Directory configuration fiel
Credential-holding attackers can completely bypass TOTP two-factor authentication on Sync-in Server versions prior to 2.
A broken authentication vulnerability in 4D SAS 4D Server software v17, v18, v19 R7, and earlier allows attackers to sen
An information disclosure vulnerability in 4D SAS 4D Server Application v17, v18, v19 R7 and earlier allows attackers to
Privilege escalation in self-hosted Bitwarden Server before 2026.5.0 lets an authenticated organization member holding a
GitHub PoC
Exploit-DB