CVE-2023-22471

    Dashboard / Vulnerabilities / CVE-2023-22471

    CVE-2023-22471

    Published: 14 Jan 2023Last Modified: 12 Aug 2026

    Summary: Nextcloud Deck vulnerable to authorization bypass

    Details: Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. Broken access control allows a user to delete attachments of other users. There are currently no known workarounds. It is recommended that the Nextcloud Deck app is upgraded to 1.6.5 or 1.7.3 or 1.8.2.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22471.json, https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2vw5-pfg6-3wm6, https://nvd.nist.gov/vuln/detail/CVE-2023-22471, https://github.com/nextcloud/deck/pull/4173

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -e9e55f8091a6ddfbc45a5b974722bfe3dcf77c0e

    Affected versions

    v1.8.1
    v1.8.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-22471 | CVE-DB