NextCloud Server, NextCloud Enterprise Server vulnerabilities

In Nextcloud Server versions 25.0.0 to 25.0.7 and 26.0.0 to 26.0.2, as well as in Nextcloud Enterprise Server versions 19.0.0 to 19.0.13.9, there was a vulnerability that allowed users to access another user's login credentials and take over their account. This issue has been patched in newer versions of the software.

NextCloud Server and NextCloud Enterprise Server have a vulnerability that allows a malicious server to modify or delete VCards in the system address book when two servers are registered as trusted and exchange share secrets. This affects versions from 25.0.0 to 25.0.7 and from 26.0.0 to 26.0.2, as well as various versions of Nextcloud Enterprise Server.

NextCloud Server and NextCloud Enterprise Server have a vulnerability that allows an attacker to bruteforce password reset links in specific versions of the software. This affects versions 25.0.0 to 25.0.7 and 26.0.0 to 26.0.2 for NextCloud Server and various versions of NextCloud Enterprise Server.

NextCloud Server and NextCloud Enterprise Server provide file storage for a productivity platform. In versions 26.0.0 to 26.0.2, an attacker could supply a URL that redirects an unsuspecting user from a legitimate domain to an attacker's site.