BIT-nextcloud-2022-24885

vendorUSosv

Improper Authentication in Nextcloud Android Files

view advisory published 2026-07-12Licence: per source

Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. Prior to version 3.19.1, users can bypass a lock on the Nextcloud app on an Android device by repeatedly reopening the app. Version 3.19.1 contains a fix for the problem. There are currently no known workarounds.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-24885US	low2.4	0.47% (41st)	—	2022-04-27
Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. Prior to version 3.19.1, users can bypass a lock on the Nextcloud app on an Android…

references

External citations — patches, advisories, analysis.

https://github.com/nextcloud/android/pull/9816ADVISORY
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-32j4-9xf3-h2mgADVISORY
https://hackerone.com/reports/1450368ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2022-24885WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan