CVE-2025-47792

MEDIUM

Nextcloud Desktop < 3.15.0 - Unauthenticated Improper Access Control via Socket API

Title source: llm

Description

Nextcloud Desktop is the desktop sync client for Nextcloud. In versions of Nextcloud Desktop prior to 3.15, 3rdparty applications already installed on a user machine can create link shares for almost all data via the socket API. These shares can then be easily sent off to an external service. Nextcloud Desktop fixes the issue in version 3.15. No known workarounds are available.

References (3)

Core 3

Core References

Third Party Advisory x_refsource_confirm

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-qm2f-959g-7p65

Patch x_refsource_misc

https://github.com/nextcloud/desktop/pull/7517

Permissions Required x_refsource_misc

https://hackerone.com/reports/1995856

Scores

CVSS v3 5.0

EPSS 0.0004

EPSS Percentile 11.5%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-284 CWE-862

Status published

Products (1)

nextcloud/desktop < 3.15.0

Published May 16, 2025

Tracked Since Feb 18, 2026