CVE-2022-29163

    Dashboard / Vulnerabilities / CVE-2022-29163

    CVE-2022-29163

    Published: 20 May 2022Last Modified: 12 Aug 2026

    Summary: Bypass of password requirements when sharing a folder via the Circles app in Nextcloud Server

    Details: Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.6 and 23.0.3, a user can create a link that is not password protected even if the administrator requires links to be password protected. Versions 22.2.6 and 23.0.3 contain a patch for this issue. There are currently no known workarounds.

    References: https://hackerone.com/reports/1406926, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29163.json, https://github.com/nextcloud/security-advisories/security/advisories/GHSA-pwjv-h37v-c4fx, https://nvd.nist.gov/vuln/detail/CVE-2022-29163, https://github.com/nextcloud/circles/pull/866, https://github.com/nextcloud/circles/pull/926

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -be64394d00871cd5326ad2c4ca1a8e1a7d087655

    Affected versions

    v22.2.6rc2
    v22.2.6rc1
    v22.2.5rc1
    v22.2.5
    v22.2.4
    v22.2.4rc3
    v22.2.4rc2
    v22.2.4rc1
    v22.2.3
    v22.2.2
    v22.2.1rc1
    v22.2.1
    v22.2.0rc2
    v22.2.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-29163 | CVE-DB