CVE-2023-26482: Scope of workflow operations is not validated in nextcloud server
Nextcloud server is an open source home cloud implementation. In affected versions a missing scope validation allowed users to create workflows which are designed to be only available for administrators. Some workflows are designed to be RCE by invoking defined scripts, in order to generate PDFs, invoking webhooks or running scripts on the server. Due to this combination depending on the available apps the issue can result in a RCE at the end. It is recommended that the Nextcloud Server is upgraded to 24.0.10 or 25.0.4. Users unable to upgrade should disable app workflowscripts and workflowpdfconverter as a mitigation.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-26482?
CVE-2023-26482 is a vulnerability in Nextcloud server that allows users to create workflows with RCE capabilities.
Which versions of Nextcloud server are affected by CVE-2023-26482?
Nextcloud server versions 18.0.0 to 25.0.4 are affected by CVE-2023-26482.
What is the severity of CVE-2023-26482?
CVE-2023-26482 has a severity rating of 8.8 (Critical).
How can I fix CVE-2023-26482?
To fix CVE-2023-26482, users are advised to update their Nextcloud server to the latest version available.
Where can I find more information about CVE-2023-26482?
More information about CVE-2023-26482 can be found in the Nextcloud security advisories and the Nextcloud server commit on GitHub.