CVE-2024-52509

Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. The Nextcloud mail app incorrectly allowed attaching shared files without download permissions as attachments. This allowed users to send them the files to themselves and then downloading it from their mail clients. It is recommended that the Nextcloud Mail is upgraded to 2.2.10, 3.6.2 or 3.7.2.

• CWE-284

• https://github.com/nextcloud/mail/commit/8d44f1ce44684022aa4e62a3e0462fdadcde6c8bPatch
• https://github.com/nextcloud/mail/pull/9592Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pwpp-fvcr-w862Patch, Vendor Advisory
• https://hackerone.com/reports/1878255Issue Tracking

Published

Nov 15, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-52503Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2024-52504A vulnerability has been identified in SIPROTEC 4 6MD61 (All…8.7
• CVE-2024-52505matrix-appservice-irc is a Node.js IRC bridge for the Matrix…5.4
• CVE-2024-52506Graylog is a free and open log management platform. The repo…6.5
• CVE-2024-52507Nextcloud Tables allows users to to create tables with indiv…4.3
• CVE-2024-52508Nextcloud Mail is the mail app for Nextcloud, a self-hosted …8.1
• CVE-2024-5251The Ultimate Addons for WPBakery plugin for WordPress is vul…5.4
• CVE-2024-52510The Nextcloud Desktop Client is a tool to synchronize files …7.5
• CVE-2024-52511Nextcloud Tables allows users to to create tables with indiv…6.5
• CVE-2024-52512user_oidc app is an OpenID Connect user backend for Nextclou…6.1
• CVE-2024-52513Nextcloud Server is a self hosted personal cloud system. Aft…4.3
• CVE-2024-52514Nextcloud Server is a self hosted personal cloud system. Aft…3.5