CVE-2022-24889

Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 21.0.8, 22.2.4, and 23.0.1, it is possible to trick administrators into enabling "recommended" apps for the Nextcloud server that they do not need, thus expanding their attack surface unnecessarily. This issue is fixed in versions 21.0.8 , 22.2.4, and 23.0.1.

• CWE-345
• CWE-345

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5vw6-6prg-gvw6Third Party Advisory
• https://github.com/nextcloud/server/pull/30615Third Party Advisory
• https://hackerone.com/reports/1403614Exploit, Third Party Advisory
• https://security.gentoo.org/glsa/202208-17Third Party Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5vw6-6prg-gvw6Third Party Advisory
• https://github.com/nextcloud/server/pull/30615Third Party Advisory
• https://hackerone.com/reports/1403614Exploit, Third Party Advisory
• https://security.gentoo.org/glsa/202208-17Third Party Advisory

Published

Apr 27, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24883FreeRDP is a free implementation of the Remote Desktop Proto…9.8
• CVE-2022-24884ecdsautils is a tiny collection of programs used for ECDSA (…7.5
• CVE-2022-24885Nextcloud Android app is the Android client for Nextcloud, a…2.4
• CVE-2022-24886Nextcloud Android app is the Android client for Nextcloud, a…3.8
• CVE-2022-24887Nextcloud Talk is a video and audio conferencing app for Nex…6.1
• CVE-2022-24888Nextcloud Server is the file server software for Nextcloud, …4.3
• CVE-2022-2489A vulnerability was found in SourceCodester Simple E-Learnin…8.8
• CVE-2022-24890Nextcloud Talk is a video and audio conferencing app for Nex…4.3
• CVE-2022-24891ESAPI (The OWASP Enterprise Security API) is a free, open so…6.1
• CVE-2022-24892Shopware is an open source e-commerce software platform. Sta…7.5
• CVE-2022-24893ESP-IDF is the official development framework for Espressif …8.8
• CVE-2022-24894Symfony is a PHP framework for web and console applications …8.8