CVE-2022-29159

Nextcloud Deck is a Kanban-style project & personal management tool for Nextcloud. In versions prior to 1.4.8, 1.5.6, and 1.6.1, an authenticated user can move stacks with cards from their own board to a board of another user. The Nextcloud Deck app contains a patch for this issue in versions 1.4.8, 1.5.6, and 1.6.1. There are no known currently-known workarounds available.

• CWE-639
• CWE-639

• https://github.com/nextcloud/deck/pull/3541Issue Tracking, Patch, Third Party Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vqhf-673w-7r3jExploit, Issue Tracking, Third Party Advisory
• https://hackerone.com/reports/1450117Exploit, Issue Tracking, Third Party Advisory
• https://github.com/nextcloud/deck/pull/3541Issue Tracking, Patch, Third Party Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vqhf-673w-7r3jExploit, Issue Tracking, Third Party Advisory
• https://hackerone.com/reports/1450117Exploit, Issue Tracking, Third Party Advisory

Published

May 20, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-29152The Ericom PowerTerm WebConnect 6.0 login portal can unsafel…6.1
• CVE-2022-29153HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9,…7.5
• CVE-2022-29154An issue was discovered in rsync before 3.2.5 that allows ma…7.4
• CVE-2022-29155In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL …9.8
• CVE-2022-29156drivers/infiniband/ulp/rtrs/rtrs-clt.c in the Linux kernel b…7.8
• CVE-2022-29158Apache OFBiz up to version 18.12.05 is vulnerable to Regular…7.5
• CVE-2022-29160Nextcloud Android is the Android client for Nextcloud, a sel…3.3
• CVE-2022-29161XWiki Platform is a generic wiki platform offering runtime s…9.8
• CVE-2022-29162runc is a CLI tool for spawning and running containers on Li…7.8
• CVE-2022-29163Nextcloud Server is the file server software for Nextcloud, …4.3
• CVE-2022-29164Argo Workflows is an open source container-native workflow e…7.1
• CVE-2022-29165Argo CD is a declarative, GitOps continuous delivery tool fo…10