CVE-2026-77172
Description
A flaw was found in Nextcloud Server. Application passwords were permitted to bypass password confirmation on sensitive endpoints. An attacker with access to a valid application password could perform operations on sensitive endpoints that normally require re-confirmation of the account password, bypassing the intended confirmation protection.
Statement
This flaw is assessed as having a Moderate severity because exploitation requires an attacker to already possess authenticated application credentials, restricting the risk to unauthorized operations on sensitive endpoints without enabling arbitrary remote code execution. Nextcloud Server is not shipped, distributed, or supported in Red Hat Enterprise Linux or any other Red Hat product offerings. Consequently, default Red Hat environments are not affected by this vulnerability.
Mitigation
No Red Hat product ships the affected component, so no mitigation is required for Red Hat offerings. Upstream fixed the flaw in Nextcloud Server 34.0.1; the versions currently shipped by Fedora and EPEL (34.0.5 stable, 35.0.2 testing) already contain the fix.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
