CVE-2024-52509

LOW

Nextcloud Mail 2.2.0-2.2.9 - Improper Access Control via Shared File Attachment

Title source: llm
STIX 2.1

Description

Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. The Nextcloud mail app incorrectly allowed attaching shared files without download permissions as attachments. This allowed users to send them the files to themselves and then downloading it from their mail clients. It is recommended that the Nextcloud Mail is upgraded to 2.2.10, 3.6.2 or 3.7.2.

References (4)

Core 4

Scores

CVSS v3 3.5
EPSS 0.0032
EPSS Percentile 54.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-284
Status published
Products (1)
nextcloud/mail 2.2.0 - 2.2.10
Published Nov 15, 2024
Tracked Since Feb 18, 2026