CVE-2023-30539: Users can set up workflows using restricted and invisible system tags in Nextcloud
Nextcloud is a personal home server system. Depending on the set up tags and other workflows this issue can be used to limit access of others or being able to grant them access when there are system tag based files access control or files retention rules. It is recommended that the Nextcloud Server is upgraded to 24.0.11 or 25.0.5, the Nextcloud Enterprise Server to 21.0.9.11, 22.2.10.11, 23.0.12.6, 24.0.11 or 25.0.5, and the Nextcloud Files automated tagging app to 1.11.1, 1.12.1, 1.13.1, 1.14.2, 1.15.3 or 1.16.1. Users unable to upgrade should disable all workflow related apps. Users are advised to upgrade.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-30539?
CVE-2023-30539 is a vulnerability in Nextcloud Files Automated Tagging that can be exploited to limit or grant access to files based on system tags or retention rules.
What is the severity of CVE-2023-30539?
CVE-2023-30539 has a severity rating of 8.8, which is considered high.
Which software versions are affected by CVE-2023-30539?
The affected software versions include Nextcloud Files Automated Tagging versions 1.11.0 to 1.16.0 and Nextcloud Server versions 21.0.0 to 25.0.5.
How can I fix CVE-2023-30539?
To fix CVE-2023-30539, it is recommended to update Nextcloud Files Automated Tagging to version 1.16.1 or later, and Nextcloud Server to version 25.0.6 or later.
Where can I find more information about CVE-2023-30539?
You can find more information about CVE-2023-30539 on the Nextcloud security advisories page.