Product by Nextcloud
Nextcloud Mail
15 known vulnerabilities in Nextcloud Mail (Nextcloud), 0 of them actively exploited (CISA KEV).
Key figures
15
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
2
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2021-32652 | Missing permission check on email metadata retrieval | 8.8 | |
| High | CVE-2024-52508 | Nextcloud Mail auto configurator can be tricked into sending account information to wrong servers | 8.2 | |
| Critical | CVE-2022-31132 | Unauthenticated SSRF in 3rd party module "cerdic/csstidy" | 8.3 | |
| High | CVE-2020-8156 | Nextcloud Mail: Improper Certificate Validation | 7.0 | |
| Medium | CVE-2021-32707 | Bypass of image blocking in Nextcloud Mail | 4.3 | |
| Medium | CVE-2023-23943 | Blind SSRF via server URL input in the Nextcloud Mail app | 5.0 | |
| Medium | CVE-2023-45660 | Require strict cookies for image proxy requests in Nextcloud Mail | 4.3 | |
| Critical | CVE-2023-48307 | Nextcloud Mail app vulnerable to Server-Side Request Forgery | 3.5 | |
| Low | CVE-2021-39220 | Bypass of image blocking in Nextcloud Mail | 3.5 | |
| Medium | CVE-2022-31119 | Password disclosure in log file in Nextcloud Mail App | 3.1 | |
| Medium | CVE-2024-52509 | Nextcloud Mail app does not respect download permissions in shares | 3.5 | |
| Medium | CVE-2023-33184 | Blind SSRF in the Nextcloud Mail app on avatar endpoint | 3.5 | |
| Medium | CVE-2023-25160 | IDOR Vulnerability in Nextcloud Mail | 4.1 | |
| Medium | CVE-2025-66514 | Nextcloud Mail stored HTML injection in subject text | 3.5 | |
| Medium | CVE-2023-23944 | Nexcloud Mail app temporarily stores cleartext password in database | 2.0 |