BIT-nextcloud-2023-49790

vendorUSosv

App PIN code can be bypassed in Nextcloud Files iOS

view advisory published 2026-07-12Licence: per source

The Nextcloud iOS Files app allows users of iOS to interact with Nextcloud, a self-hosted productivity platform. Prior to version 4.9.2, the application can be used without providing the 4 digit PIN code. Nextcloud iOS Files app should be upgraded to 4.9.2 to receive the patch. No known workarounds are available.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-49790US	medium4.3	0.29% (21st)	—	2023-12-22
The Nextcloud iOS Files app allows users of iOS to interact with Nextcloud, a self-hosted productivity platform. Prior to version 4.9.2, the application can be used without providi…

references

External citations — patches, advisories, analysis.

https://github.com/nextcloud/ios/pull/2665FIX
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-j8g7-88vv-rggvADVISORY
https://hackerone.com/reports/2245437ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2023-49790WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan