EN PT-BR
← Voltar ao feed
medium

CERT-FR warns of multiple Nextcloud vulnerabilities enabling DoS, data disclosure and security bypass (CERTFR-2026-AVI-1392)

1 fonte(s) · 1 atualização(ões) · publicado 26/10/2026 21:00 · coletado há 4 dias

CERT-FR published advisory CERTFR-2026-AVI-1392 on 27 October 2026 covering multiple vulnerabilities in Nextcloud products. According to the advisory, some flaws allow an attacker to cause a remote denial of service, breach data confidentiality and bypass the security policy. The affected products are Nextcloud Server (Community and Enterprise, branches 22 to 34) and the Collectives, Files Confidential and Richdocuments apps. The advisory reports no active exploitation and gives no CVSS scores or IOCs. It references six vendor GitHub advisories dated 27 October 2026 and six CVE identifiers.

Entenda a falha

A vulnerabilidade

CERT-FR advisory CERTFR-2026-AVI-1392 covers six CVEs (CVE-2026-114601, CVE-2026-67400, CVE-2026-77167, CVE-2026-77171, CVE-2026-77172, CVE-2026-77173) in Nextcloud Server (Community and Enterprise, 22.x to 34.x) and the Collectives, Files Confidential and Richdocuments apps. The advisory says the impacts are remote denial of service, loss of data confidentiality and security policy bypass. It does not map CVEs to flaws, components, severities or attacker prerequisites, and gives no CVSS scores, so no ranking by severity is possible. Fixed Server versions include 22.2.11, 23.0.13, 24.0.13, 25.0.14, 26.0.14, 27.1.12, 28.0.15, 29.0.17, 30.0.18, 31.0.15, 32.0.13, 33.0.7 and 34.0.2, with separate Enterprise builds for the older branches. Fixed apps: Collectives 4.4.0, Files Confidential 3.3.1, 4.1.1 and 5.1.0, Richdocuments 11.0.1, 10.2.1 and 9.1.1.

Como funciona

The articles do not describe how the vulnerable processes work. The CERT-FR advisory only lists the impact categories and points to six vendor GitHub advisories, whose content is not included in the input. Which input reaches which component, and at what step it fails, is therefore unknown from the available sources.

Por que é vulnerável

The root causes are not stated. The CERT-FR advisory does not say whether the flaws are missing checks, logic errors or something else, nor what the fixes change. The only remediation guidance is to update to the fixed versions.

Como foi descoberta

The articles do not say who found the flaws or how. CERT-FR published its advisory on 27 October 2026, the same date as six Nextcloud GitHub security advisories (GHSA-5572-968j-v7g5, GHSA-6m4h-j3wr-v388, GHSA-p9qq-6vpv-x7wj, GHSA-qwm4-h3xh-gmvc, GHSA-w7pp-8m7c-555c, GHSA-x4hv-m8g6-5cj4). The advisory reports no active exploitation.

Explicação gerada por IA a partir da matéria e dos artigos, em 28/10/2026 14:27.

Detalhes técnicos

  • Impacts listed: confidentiality breach, security policy bypass, remote denial of service.
  • CVEs: CVE-2026-114601, CVE-2026-67400, CVE-2026-77167, CVE-2026-77171, CVE-2026-77172, CVE-2026-77173.
  • Vendor advisories: GHSA-5572-968j-v7g5, GHSA-6m4h-j3wr-v388, GHSA-p9qq-6vpv-x7wj, GHSA-qwm4-h3xh-gmvc, GHSA-w7pp-8m7c-555c, GHSA-x4hv-m8g6-5cj4.
  • Affected apps: Collectives after 4.0.0 and before 4.4.0; Files Confidential 3.3.x before 3.3.1, after 4.0.0 and before 4.1.1, and after 5.0.0 and before 5.1.0; Richdocuments 11.0.x before 11.0.1, after 10.0.0 and before 10.2.1, and after 9.0.0 and before 9.1.1.
  • Affected Server versions (fixed in Community / Enterprise builds): 22.x before 22.2.11 / 22.2.10.42; 23.0.x before 23.0.13 / 23.0.12.38; 24.0.x before 24.0.13 / 24.0.12.37; 25.0.x before 25.0.14 / 25.0.13.32; 26.0.x before 26.0.14 / 26.0.13.29; 27.x before 27.1.12 / 27.1.11.29; 28.0.x before 28.0.15 / 28.0.14.20; 29.0.x before 29.0.17 / 29.0.16.19; 30.0.x before 30.0.18 / 30.0.17.12; 31.0.x before 31.0.15 / 31.0.14.8; 32.0.x before 32.0.13; 33.0.x before 33.0.7; 34.0.x before 34.0.2.
  • The advisory does not map individual CVEs to flaws, root causes or severities.

Remediação

  • Consult the Nextcloud security advisories for the fixes, as CERT-FR directs.
  • Update Nextcloud Server and the affected apps to the fixed versions listed above.

Linha do tempo

  1. cert.cyber.gouv.fr ↗ · pub. 26/10/2026 21:00 · coletado 28/10 14:01 primeiro registro

    CERT-FR warns of multiple Nextcloud vulnerabilities enabling DoS, data disclosure and security bypass (CERTFR-2026-AVI-1392)

    ler a análise desta fonte

    CERT-FR published advisory CERTFR-2026-AVI-1392 on 27 October 2026 covering multiple vulnerabilities in Nextcloud products. According to the advisory, some flaws allow an attacker to cause a remote denial of service, breach data confidentiality and bypass the security policy. The affected products are Nextcloud Server (Community and Enterprise, branches 22 to 34) and the Collectives, Files Confidential and Richdocuments apps. The advisory reports no active exploitation and gives no CVSS scores or IOCs. It references six vendor GitHub advisories dated 27 October 2026 and six CVE identifiers.

    Technical Details

    • Impacts listed: confidentiality breach, security policy bypass, remote denial of service.
    • CVEs: CVE-2026-114601, CVE-2026-67400, CVE-2026-77167, CVE-2026-77171, CVE-2026-77172, CVE-2026-77173.
    • Vendor advisories: GHSA-5572-968j-v7g5, GHSA-6m4h-j3wr-v388, GHSA-p9qq-6vpv-x7wj, GHSA-qwm4-h3xh-gmvc, GHSA-w7pp-8m7c-555c, GHSA-x4hv-m8g6-5cj4.
    • Affected apps: Collectives after 4.0.0 and before 4.4.0; Files Confidential 3.3.x before 3.3.1, after 4.0.0 and before 4.1.1, and after 5.0.0 and before 5.1.0; Richdocuments 11.0.x before 11.0.1, after 10.0.0 and before 10.2.1, and after 9.0.0 and before 9.1.1.
    • Affected Server versions (fixed in Community / Enterprise builds): 22.x before 22.2.11 / 22.2.10.42; 23.0.x before 23.0.13 / 23.0.12.38; 24.0.x before 24.0.13 / 24.0.12.37; 25.0.x before 25.0.14 / 25.0.13.32; 26.0.x before 26.0.14 / 26.0.13.29; 27.x before 27.1.12 / 27.1.11.29; 28.0.x before 28.0.15 / 28.0.14.20; 29.0.x before 29.0.17 / 29.0.16.19; 30.0.x before 30.0.18 / 30.0.17.12; 31.0.x before 31.0.15 / 31.0.14.8; 32.0.x before 32.0.13; 33.0.x before 33.0.7; 34.0.x before 34.0.2.
    • The advisory does not map individual CVEs to flaws, root causes or severities.

    Remediation

    • Consult the Nextcloud security advisories for the fixes, as CERT-FR directs.
    • Update Nextcloud Server and the affected apps to the fixed versions listed above.