CVE-2026-45153: Nextcloud: PIN bypass in PassCodeActivity via back button
Nextcloud is an open source content collaboration platform. From version 33.0.0 to before version 33.1.0, after unlocking a locked Android phone the back-button could be used to bypass the Nextcloud Files app PIN. This issue has been patched in version 33.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nextcloudto a version that resolves this vulnerability.Fixed in 33.1.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45153?
The severity of CVE-2026-45153 is rated as medium with a score of 4.6.
How do I fix CVE-2026-45153?
To fix CVE-2026-45153, update the Nextcloud Android app to version 33.1.0 or later.
What is the impact of CVE-2026-45153?
The impact of CVE-2026-45153 allows unauthorized access to Nextcloud files by bypassing the app PIN using the back button.
Which versions are affected by CVE-2026-45153?
CVE-2026-45153 affects Nextcloud Android app versions from 33.0.0 to before 33.1.0.
Who can exploit CVE-2026-45153?
CVE-2026-45153 can potentially be exploited by any user who has physical access to a locked Android phone with the Nextcloud app.