CVE-2022-29159

    Dashboard / Vulnerabilities / CVE-2022-29159

    CVE-2022-29159

    Published: 20 May 2022Last Modified: 12 Aug 2026

    Summary: Possibility for anyone to add a stack with existing tasks on anyone's board in Nextcloud Deck

    Details: Nextcloud Deck is a Kanban-style project & personal management tool for Nextcloud. In versions prior to 1.4.8, 1.5.6, and 1.6.1, an authenticated user can move stacks with cards from their own board to a board of another user. The Nextcloud Deck app contains a patch for this issue in versions 1.4.8, 1.5.6, and 1.6.1. There are no known currently-known workarounds available.

    References: https://hackerone.com/reports/1450117, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29159.json, https://github.com/nextcloud/security-advisories/security/advisories/GHSA-vqhf-673w-7r3j, https://nvd.nist.gov/vuln/detail/CVE-2022-29159, https://github.com/nextcloud/deck/pull/3541

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -4e14dfb15f98717d13272e52694c80a51b4ae72f

    Affected versions

    = 1.6.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-29159 | CVE-DB