CVE-2023-35172

NextCloud Server and NextCloud Enterprise Server provide file storage for Nextcloud, a self-hosted productivity platform. In NextCloud Server versions 25.0.0 until 25.0.7 and 26.0.0 until 26.0.2 and Nextcloud Enterprise Server versions 21.0.0 until 21.0.9.12, 22.0.0 until 22.2.10.12, 23.0.0 until 23.0.12.7, 24.0.0 until 24.0.12.2, 25.0.0 until 25.0.7, and 26.0.0 until 26.0.2, an attacker can bruteforce the password reset links. Nextcloud Server n 25.0.7 and 26.0.2 and Nextcloud Enterprise Server 21.0.9.12, 22.2.10.12, 23.0.12.7, 24.0.12.2, 25.0.7, and 26.0.2 contain a patch for this issue. No known workarounds are available.

• CWE-307

• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mjf5-p765-qmr6Vendor Advisory
• https://github.com/nextcloud/server/pull/38267Issue Tracking
• https://hackerone.com/reports/1987062Permissions Required
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mjf5-p765-qmr6Vendor Advisory
• https://github.com/nextcloud/server/pull/38267Issue Tracking
• https://hackerone.com/reports/1987062Permissions Required

Published

Jun 23, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-35167Remult is a CRUD framework for full-stack TypeScript. If you…6.3
• CVE-2023-35168DataEase is an open source data visualization analysis tool …6.5
• CVE-2023-35169PHP-IMAP is a wrapper for common IMAP communication without …9.8
• CVE-2023-3517 Hitachi Vantara Pentaho Data Integration & Analytics versio…8.8
• CVE-2023-35170Rejected reason: This CVE is a duplicate of another CVE.
• CVE-2023-35171NextCloud Server and NextCloud Enterprise Server provide fil…6.1
• CVE-2023-35173Nextcloud End-to-end encryption app provides all the necessa…6.5
• CVE-2023-35174Livebook is a web application for writing interactive and co…9.8
• CVE-2023-35175Certain HP LaserJet Pro print products are potentially vulne…9.8
• CVE-2023-35176Certain HP LaserJet Pro print products are potentially vulne…8.8
• CVE-2023-35177Certain HP LaserJet Pro print products are potentially vulne…8.8
• CVE-2023-35178Certain HP LaserJet Pro print products are potentially vulne…8.8