CVE-2023-26482: Nextcloud server is an open source home cloud implementation. In affected versions a missing scope validation allowed users to create workflows which ...

Description

Nextcloud server is an open source home cloud implementation. In affected versions a missing scope validation allowed users to create workflows which are designed to be only available for administrators. Some workflows are designed to be RCE by invoking defined scripts, in order to generate PDFs, invoking webhooks or running scripts on the server. Due to this combination depending on the available apps the issue can result in a RCE at the end. It is recommended that the Nextcloud Server is upgraded to 24.0.10 or 25.0.4. Users unable to upgrade should disable app `workflow_scripts` and `workflow_pdf_converter` as a mitigation.

Metrics

CVSS 3.1

8.8/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

4.18%

89.6th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-78

Affected Software

Vendor	Product	Versions
Nextcloud	Nextcloud Server	>= 18.0.0, < 20.0.14.12
Nextcloud	Nextcloud Server	>= 21.0.0, < 21.0.9.10
Nextcloud	Nextcloud Server	>= 22.0.0, < 22.2.10.10
Nextcloud	Nextcloud Server	>= 23.0.0, < 23.0.12.5
Nextcloud	Nextcloud Server	>= 24.0.0, < 24.0.10
Nextcloud	Nextcloud Server	>= 25.0.0, < 25.0.4

References

Timeline

Published: Mar 30, 2023
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2023-26482?

Nextcloud server is an open source home cloud implementation. In affected versions a missing scope validation allowed users to create workflows which are designed to be only available for administrators. Some workflows are designed to be RCE by invoking defined scripts, in order to generate PDFs, invoking webhooks or running scripts on the server. Due to this combination depending on the available apps the issue can result in a RCE at the end. It is recommended that the Nextcloud Server is upgraded to 24.0.10 or 25.0.4. Users unable to upgrade should disable app `workflow_scripts` and `workflow_pdf_converter` as a mitigation.

How severe is CVE-2023-26482?

CVE-2023-26482 has a CVSS score of 8.8/10 (HIGH severity). The EPSS model estimates a 4.18% probability of exploitation in the next 30 days.

How do I fix CVE-2023-26482?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.